2

Every Mac OS X system in my company uses 3 local users accounts.

1st user is a local administrator user, the 2nd user is a local standard user and the 3rd user is a local administrator user.

The 3rd user account is being used from my Security Department to scan our Mac OS X systems.

This 3rd user has never been logged into the system.

The 3rd user is there, but this user does not have a regular /Users/username path folder. Again it is there, I can use it, I can SSH, etc. but once again does not have a regular /Users/username home path because we never log in.

I need to create a bash script that will change and update this 3rd user password.

Surfing the web, I found this solution:

sudo /usr/bin/dscl . -passwd /Users/username newpassword
sudo security set-keychain-password -o oldpassword -p newpassword /Users/username/Library/Keychains/login.keychain

My problem is that the user does not have a regular /Users/username home path, because we never log in. We just created the user so the Security team can use it for scanning.

How can I create a bash script that will change the password?

Just so you know, the user has been created with the following script:

USERNAME="Batman"
USERFULLNAME="Batman Scan User"
USERUID="512"
USERPASS="BatmanPassword"

dscl . -create /Users/"${USERNAME}" isHidden 1
dscl . -create /Users/"${USERNAME}" UserShell /bin/bash
dscl . -create /Users/"${USERNAME}" RealName "${USERFULLNAME}"
dscl . -create /Users/"${USERNAME}" UniqueID "${USERUID}"
dscl . -create /Users/"${USERNAME}" PrimaryGroupID 20
dscl . -create /Users/"${USERNAME}" NFSHomeDirectory /Users/"${USERNAME}"
dscl . -passwd /Users/"${USERNAME}" "${USERPASS}"
dscl . -append /Groups/admin GroupMembership "${USERNAME}"
  • Can you clarify that the the user doesn't have a regular home path? Its NFSHomeDirectory is set to /Users/Batman; does that directory exist? If it does, does /Users/Batman/Library/Keychains exist, and does it contain a login.keychain and/or a subdirectory with a GUID for a name? – Gordon Davisson Jul 22 at 21:36
  • Just set the password, the credentials don’t care if there is a home folder or anyone has logged in. Or to put it another way, what’s the error when you call passwd against the user? – bmike Jul 22 at 23:15
  • I run the posters commands. dscl . -create /Users/"${USERNAME}" NFSHomeDirectory /Users/"${USERNAME}". did not create a directory for Batman. I run dscl . -list /Users UniqueID and saw that the user was created. – historystamp Jul 23 at 2:08
  • consquently, sudo security set-keychain-password -o oldpassword -p newpassword /Users/username/Library/Keychains/login.keychain has no keychain to alter. You do not need to run this command to change the user's password. – historystamp Jul 23 at 2:10
  • You left out the command: createhomedir -u $UserName -c see gist.github.com/igorvoltaic/ff3eed83aa0c37a85d1802b4fa40609a – historystamp Jul 23 at 2:19
2

I would just make new accounts with the credentials you need and worry about deleting the broken ones later.

If your MDM is JAMF, use their tool to automate hidden admin account creation and push the script out. If not, look for the github / Mac App Store tool CreateUserPkg

I wouldn’t reinvent the wheel here and instead, stand on the shoulders of these giants above.

  • The post says everything is working, but wants to change the password. So, poster should change the password. – historystamp Jul 23 at 2:19
  • 2
    @historystamp My answer is documented, tried, tested and scales. It doesn’t prevent anyone else (or you) from stepping up with a better solution as well. Additionally my answer bumps the question and signals that someone cares enough to answer. (Also, I’m the only person who has voted up this question) Is there harm in having alternatives? – bmike Jul 23 at 3:00
  • 1
    bmike I will follow your suggestions. It make much more sense to delete the account completely and re add a new one with the new password. All the other helps are good and valid points but there are so much going on between the keychain password, the sync, etc. – Fabio Viola Jul 23 at 13:42
2

You should be able to just run

sudo /usr/bin/dscl . -passwd /Users/username newpassword

to change the password. The path is only relevant within Directory Services here, it doesn't need to be reflected on disk.

The second command (sudo security set-keychain-password) is about changing the password to Keychain data, but as long as the user doesn't have any keychain to start with there is no need (and no way) to change it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .