Jira (PUP-10246) Cannot set/change password on macOS 10.15

[Gabriel Nagy (JIRA)]

Title: Message Title

Gabriel Nagy created an issue   Puppet / PUP-10246 Cannot set/change password on macOS 10.15 Issue Type: Bug Assignee: Unassigned Created: 2020/01/21 6:28 AM Priority: Normal Reporter: Gabriel Nagy It looks like direct access to binary plists under /var/db/dslocal/nodes/Default/ has been blocked beginning with macOS 10.15 (even with Full Disk Access activated), so we can no longer overwrite that file to set/change the password on an macOS user. Error: Unable to write the file /var/db/dslocal/nodes/Default/users/testuser.plist. #<IOError: File /var/db/dslocal/nodes/Default/users/testuser.plist not writable!> There's still a way to circumvent this and still be able to modify passwords. It involves the use of the dsimport command to indirectly manipulate the contents of the binary user plist. For this, we need to have the ShadowHashData (which we previously wrote to the plist) in binary format, then converted to base64. Here is some ancient dsimport documentation (Apple seems to have removed all mentions of this tool since, but it still works): http://web.archive.org/web/20090106120111/http://support.apple.com/kb/TA21305?viewlocale=en_US Basically the steps would be to: 1. If the user exists, remove the existing ShadowHashData (with dscl delete) dscl -plist . read /Users/testuser should show no ShadowHashData 2. Import the file with the base64-converted hash using dsimport: dsimport /file/to/import /Local/Default M dscl -plist . read /Users/testuser should show the new ShadowHashData The challenge that remains is to correctly build the ShadowHashData plist, convert it to binary and then to base64, then build the dsimport file. As per the documentation above, this is a file that changes the hashed password of an existing account: 0x0A 0x5C 0x3A 0x2C dsRecTypeStandard:Users 2 dsAttrTypeStandard:RecordName base64:dsAttrTypeNative:ShadowHashData testuser:<base64 string> Add Comment   This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-bugs/JIRA.342832.1579616899000.30108.1579616940467%40Atlassian.JIRA.