|
Page 1 of 2    This command line tool ("OFPW") can set the Open Firmware security-mode and security-password, when executed with sudo or as the "root" user context (ie, from within Login and Logout Hooks, logged in as root, etc.).
OFPW is ready for Mac OS X 10.4 (Tiger) !
Why use the OFPW tool versus Apple's nvram tool?
- This tool can set the open firmware password without having to know the encryption method of the password. To set the security-password with Apple's nvram tool via the command line, you must know what the encrypted password string is on a Mac that has the password already set via the Open Firmware interface at bootup time:
- The OFPW tool can change the security-mode regardless of the previous
state of the nvram. Apple's /usr/sbin/nvram tool had a problem doing this in Mac OS X 10.3.9 and earlier. Apple fixed this bug in Mac OS X 10.4 (Tiger).
Most administrators will use the "command" mode which displays the password dialog pictured below when the OPTION key is held down at bootup, immediately after the startup "Bong". The other 2 modes are "none" which doesn't require any password entry, and the other is "full" which will cause the Mac to go directly into Open Firmware and require a password to do anything.
Setting the security-mode to "command" and the password to anything non-blank
forces a user who attempts to boot from another device (hold down the Option
key on restart) to enter a password. Command mode disables all "snag" keys
except the Option key at bootup time. Entering single user mode is also prevented.
The Open Firmware password dialog is displayed when the mode is changed to command
and the Option key is held down at boot up time:
System Requirements:
- The Macintosh must be capable of supporting Open Firmware security
- You must have an administrator account on the Mac
This command line tool was created for 2 reasons:
- To set the Open Firmware password via cleartext
- To change the security-mode to "none", "command" or "full". This is
essential to programmatically/automatically setting the security-mode
and password on Macs right out of the box. This is highly desirable
in an enterprise/large installation of Macs.
Download the OFPW tool, mount the disk image,
and then install it in /usr/local/bin by entering this in the terminal:
sudo mkdir -p /usr/local/bin/
sudo cp /Volumes/OFPW-Tool/OFPW /usr/local/bin/
Make sure that the owners and groups are correct and that the execute flag is set for the root user:
sudo chown root:admin /usr/local/bin/OFPW
sudo chmod 700 /usr/local/bin/OFPW
To set the Open Firmware password:
sudo /usr/local/bin/OFPW -pass [theClearTextPassword]
NOTE: For the password, use characters that have ASCII values from 32 to 127 (inclusive) and do NOT use the capital letter "U" due to a bug in Open Firmware.
To change the security mode: [0 = None, 1 = Command, 2 = Full]
sudo /usr/local/bin/OFPW -mode 1
Note that you can only set 1 attribute at a time. That is, you can set the mode or password first, but you can't set the password and the mode on one line. You must call ofpw to set the password, and then again to change the mode.
We are very lucky to have this tool. The source code will not be distributed.
|
