Currently working on a deployment of a large number of Mac's, on which I want to set the password for an administrator account without putting the password plain-text in the script. Is there some way to provide a hash of the password to dscl/passwd?
yes you can change the password by providing a hash to a script. This works for 10.7 and later (up to at least 10.9.1).
You need the hash you want to set it to. The easiest way to do this is create an account with the password you want and read the hash. The hash is stored in
Create the user the standard way (using dscl) but don't set the password using dscl instead use the defaults command.
Example for user called 'lana':
#!/bin/bash #hash to set obtained from: #defaults read /var/db/dslocal/nodes/Default/users/lana.plist ShadowHashData pw_hash='(<10145341 4c544544 ...really long...2d534841>)' #needs to be unique $uid=510 #gid of an existing group $gid=510 dscl . -create /Users/lana dscl . -create /Users/lana UserShell /bin/bash dscl . -create /Users/lana RealName "Lana May" dscl . -create /Users/lana UniqueID $uid dscl . -create /Users/lana PrimaryGroupID $gid dscl . -create /Users/lana NFSHomeDirectory /Users/lana dscl . -merge /Groups/admin GroupMembership lana defaults write "/var/db/dslocal/nodes/Default/users/lana.plist" ShadowHashData "$pw_hash"
Many years ago, I meddled with some UNIX systems where the password hash was stored in /etc/passwd, or optionally /etc/shadow.
I did a little searching and found two articles describing how the password hashes are stored on OS X:
The 2011 article says:
Each user has their own shadow file, with each shadow file stored under a .plist file located in /var/db/dslocal/nodes/Default/users/
The two articles are about cracking the passwords, rather than setting new ones, but they might provide some useful information for you.
Then I did a Google search for
dscl set ShadowHashData. The first hit was this "Payload free package to create a user on a 10.7 system" Python script:
That script seems to call
dscl -create, followed by
dscacheutil -flushcache, followed by writing some data to
I haven't looked at the script in much depth, but it might perhaps give you a starting point?