I have a Linux box running Netatalk that I use to store Time Machine backups. My machine running OS X sees this as an AFP service and Time Machine is happy with this arrangement. The only issue is that I need to manually connect to the Linux machine. I can do this by pressing buttons in Finder or I can do this form a shell with a command that looks like this:

mount -t afp afp://user:password@domain.tld/location /Volumes/mntpnt

This lets me automate connecting to the server but now I have a password saved in a plaintext shell script. What's a better way to automate this? My goal is to automatically allow Time Machine to access the Linux Machine if it can be reached.

To automate something like this with SSH I would authenticate with a passwordless key. Is there a way to do that with AFP?

I also have the password in my OS X keychain and I'm not prompted for a password if I go through Finder to connect to the Linux machine. Is there a sensible way to access to use this from a shell script?

I can provide more info about the Netatalk setup if that helps but it seems like the issue is on the client side.

1 Answer 1


Here's how you can pull the password out of the Keychain in OS X.

pw=$(security find-internet-password -wl mntpt)

This presumes the item is stored in the keychain with the name "mntpt"

Then you should be able to use your script on the next line:

mount -t afp afp://user:$pw@domain.tld/location /Volumes/mntpnt
  • I'm getting "script error: Expected class name but found property." that seems to be due to the line starting with set serverKey. Jul 20, 2015 at 22:02
  • @Praxeolitic Ah sorry, this method doesn't work since the Keychain Scripting was removed from OS X. :/ — I found another method, changing my answer.
    – ghoppe
    Jul 20, 2015 at 22:49
  • This looks promising but I'm confused by your use of mntpnt in the first command. In my example it's intended as an arbitrary directory name that doesn't necessarily have a special relation to the server. Jul 20, 2015 at 23:24
  • From the manpage on security I have this working but I'm not 100% clear,on one thing. Does "label" in the manpage correspond to the "Name" column in Keychain Access? Jul 20, 2015 at 23:27
  • @Praxeolitic Yes.
    – ghoppe
    Jul 21, 2015 at 14:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .