Change user password by providing new password as hash in a script

Question

Currently working on a deployment of a large number of Mac's, on which I want to set the password for an administrator account without putting the password plain-text in the script. Is there some way to provide a hash of the password to dscl/passwd?

Answer 1

yes you can change the password by providing a hash to a script. This works for 10.7 and later (up to at least 10.9.1).

1. You need the hash you want to set it to. The easiest way to do this is create an account with the password you want and read the hash. The hash is stored in /var/db/dslocal/nodes/Default/users/[username].plist in the ShadowHashData field

2. Create the user the standard way (using dscl) but don't set the password using dscl instead use the defaults command.

Example for user called 'lana':

#!/bin/bash

#hash to set obtained from: 
#defaults read /var/db/dslocal/nodes/Default/users/lana.plist ShadowHashData
pw_hash='(<10145341 4c544544 ...really long...2d534841>)'

#needs to be unique
$uid=510

#gid of an existing group
$gid=510

dscl . -create /Users/lana
dscl . -create /Users/lana UserShell /bin/bash
dscl . -create /Users/lana RealName "Lana May"
dscl . -create /Users/lana UniqueID $uid
dscl . -create /Users/lana PrimaryGroupID $gid
dscl . -create /Users/lana NFSHomeDirectory /Users/lana
dscl . -merge /Groups/admin GroupMembership lana
defaults write "/var/db/dslocal/nodes/Default/users/lana.plist" ShadowHashData "$pw_hash"

Answer 2

Many years ago, I meddled with some UNIX systems where the password hash was stored in /etc/passwd, or optionally /etc/shadow.

I did a little searching and found two articles describing how the password hashes are stored on OS X:

http://www.defenceindepth.net/2009/12/cracking-os-x-passwords.html http://www.defenceindepth.net/2011/09/cracking-os-x-lion-passwords.html

The 2011 article says:

Each user has their own shadow file, with each shadow file stored under a .plist file located in /var/db/dslocal/nodes/Default/users/

The two articles are about cracking the passwords, rather than setting new ones, but they might provide some useful information for you.

Then I did a Google search for dscl set ShadowHashData. The first hit was this "Payload free package to create a user on a 10.7 system" Python script:

https://gist.github.com/rustymyers/1242589

That script seems to call dscl -create, followed by dscacheutil -flushcache, followed by writing some data to /var/db/dslocal/nodes/Default/users/%s.plist.

I haven't looked at the script in much depth, but it might perhaps give you a starting point?