4

I ran to view the contents of a shadow file for a user:

sudo plutil -p /var/db/dslocal/nodes/Default/users/<username>.plist

but when I get to Default it says permission denied, either as a user or root, any ideas?

4

10.14 protects these files with SIP, so even root cannot access the files without using the directory services command. If you need to get this information deactivate SIP. Remember to reactivate SIP after you are finished. If you attempt to access using the directory services call shown above then you do not need to deactivate SIP.

| improve this answer | |
1

You need to deactivate the SIP, which protects these files. In terminal, you need to write this to disable it, and you should get this message:

csrutil disable

Successfully disabled System Integrity Protection. Please restart the machine for the changes to take effect.

restart your computer once the command is successful. Then, you type your code into terminal:

sudo plutil -p /var/db/dslocal/nodes/Default/users/<username>.plist

and extract the files accordingly.

Once you are finished, remember to re-enable the SIP.

csrutil enable
| improve this answer | |
0

Using sudo plutil -p to access these plists still works in 10.13+, even with SIP enabled. You need to grant Terminal (or iTerm) Full Disk Access in System Preferences though.

| improve this answer | |

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .