4

I am trying to set a master password from the terminal (using a shell script). I see the passwd function and the master.passwd function, however I don't see any documentation on either of these to set the master password (AFAIK, these set the user passwords only).

I am pulling my information from these sources:

http://support.apple.com/kb/ph7032 What does this command do: sudo dscl . passwd /Users/administrator thePassword https://developer.apple.com/library/mac/documentation/darwin/reference/manpages/man5/master.passwd.5.html

My question is:

Can you use the passwd or master.passwd commands to set the master password? If so, can you please provide an example for how to accomplish this?

6

First, a few things to note:

On the Mac the files /etc/passwd and /etc/master.passwd are only consulted when the Mac is booted into single user mode.

I'm not sure what you mean by "set the master password" for the Mac. Do you mean set the password for the account 'root'?

Usually you use the passwd command to change passwords from the command line (there is no master.passwd command) but you can't use it from a script as it requires input.

To change a password in a script you need to use the dscl command.

Here is an example :

dscl . -passwd /Users/tonyw newpass

Note that the above would have to be run as root, which means your script would have to be run by root. Otherwise you have to add authentication to the dscl command thus:

dscl . -u Admin -P adminpassword -passwd /Users/tonyw newpass

The user Admin must have administrator privileges for the Mac.

(All of this is incredibly insecure as you have passwords in plain text in a script.)

Of course to set the password for 'root' just change the tonyw to root in the above.

Have a good look at dscl(1) to understand the options in the above.

  • Well written and cleared up some of my misconceptions. I already have a few methods in mine to obfuscate the password out of the shell script (I will be passing it in as an argument, so it's not going to ever be plaintext) I will take your advice and review the dscl script and report back with my findings :) – Nathan Lafferty Jan 16 '14 at 20:57
  • Okay, now I've had some time to do some more research and properly analyze your question: " I'm not sure what you mean by "set the master password" for the Mac. Do you mean set the password for the account 'root'?" The master password is set for filevault. It adds in another layer of protection if you manage to forget one password (then there is an administrative that can recover your files). This is what I am talking about and I don't think I can use the dscl command to accomplish this. – Nathan Lafferty Jan 16 '14 at 21:16
  • Nathan, you notice they call it a "recovery key" not a master password in all their doco. – Tony Williams Jan 16 '14 at 23:21
  • 1
    dscl . -passwd /Users/tonyw newpass - Works great on OS X 10.9.5. – funroll Dec 10 '14 at 19:51
1

OK, for FileVault you need to use the fdesetup command. Set up a test Mac, have a long hard look at the man page and give it all a try. From the man page it looks like you can change the FileVault recovery password using the changerecovery option.

Sorry, but I'm not prepared to do the testing to give you the exact commands as getting it wrong could seriously screw my Mac. There are a bunch of examples in the man page.

BTW - I found it by going apropos FileVault at the command line. Always a good first step.

  • After talking with the project lead, it seems that he was mistaken on what the master password was. As we will not be using filevault (which is it's only use) we have decided not to worry about this. Your answer appears to be correct...but as I am not testing it I don't know whether or not I should mark it as the answer or just let it be. – Nathan Lafferty Jan 20 '14 at 18:43
1

Restart your Mac and hold Command+s, let it load, and then type:

/sbin/fsck -y
/sbin/mount -UAW

This will bring up a user directory, then type:

ls /Users/

Note let's assume account name is xyz, type:

passwd xyz

Note the command line should be blank. Type in the new password and press enter. Note the command line should be blank again.

Retype the new password and press enter. Finally type:

reboot

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .