I have a Linux box running Netatalk that I use to store Time Machine backups. My machine running OS X sees this as an AFP service and Time Machine is happy with this arrangement. The only issue is that I need to manually connect to the Linux machine. I can do this by pressing buttons in Finder or I can do this form a shell with a command that looks like this:

mount -t afp afp://user:password@domain.tld/location /Volumes/mntpnt

This lets me automate connecting to the server but now I have a password saved in a plaintext shell script. What's a better way to automate this? My goal is to automatically allow Time Machine to access the Linux Machine if it can be reached.

To automate something like this with SSH I would authenticate with a passwordless key. Is there a way to do that with AFP?

I also have the password in my OS X keychain and I'm not prompted for a password if I go through Finder to connect to the Linux machine. Is there a sensible way to access to use this from a shell script?

I can provide more info about the Netatalk setup if that helps but it seems like the issue is on the client side.


Here's how you can pull the password out of the Keychain in OS X.

pw=$(security find-internet-password -wl mntpt)

This presumes the item is stored in the keychain with the name "mntpt"

Then you should be able to use your script on the next line:

mount -t afp afp://user:$pw@domain.tld/location /Volumes/mntpnt
| improve this answer | |
  • I'm getting "script error: Expected class name but found property." that seems to be due to the line starting with set serverKey. – Praxeolitic Jul 20 '15 at 22:02
  • @Praxeolitic Ah sorry, this method doesn't work since the Keychain Scripting was removed from OS X. :/ — I found another method, changing my answer. – ghoppe Jul 20 '15 at 22:49
  • This looks promising but I'm confused by your use of mntpnt in the first command. In my example it's intended as an arbitrary directory name that doesn't necessarily have a special relation to the server. – Praxeolitic Jul 20 '15 at 23:24
  • From the manpage on security I have this working but I'm not 100% clear,on one thing. Does "label" in the manpage correspond to the "Name" column in Keychain Access? – Praxeolitic Jul 20 '15 at 23:27
  • @Praxeolitic Yes. – ghoppe Jul 21 '15 at 14:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .