Category filter

Script to enforce Password on macOS devices

Enforcing password policies is an effective technique to ensure that your employees have secure passwords and update them regularly. Hexnode provides two methods to enforce password policies on macOS devices; configuring Passcode rules via policies and by deploying scripts.

If your company has decided that the MDM Passcode payload isn’t suitable or desirable, the Execute Custom Script action can help you. Use this action to manage password restrictions on the device without involving direct user interaction.

This document contains sample code snippets that can be used to configure password policies on macOS devices.

Scripting Language – Bash

File extension – .sh

Disclaimer:

The Sample Scripts provided below are adapted from third-party Open-Source sites.

Jump To

Set Password using pwpolicy command

Set Password using pwpolicy command

pwpolicy is a command line tool that can be used to manipulate password policies. Using pwpolicy, here are some settings we can configure:

MAX_FAILED: Maximum wrong password attempts by user before device locks up.
LOCKOUT: Amount of time the device will be locked after X wrong password attempts.
PW_EXPIRE: Number of days the password is valid before it needs to be changed.
MIN_LENGTH: Minimum length of password in characters.
MIN_NUMERIC: Minimum number of numbers in the password.
MIN_ALPHA_LOWER: Minimum number of lowercase alphabets in password.
MIN_UPPER_ALPHA: Minimum number of uppercase alphabets in password.
MIN_SPECIAL_CHAR: Minimum number of special characters in password.
PW_HISTORY: Number of passwords to remember that cannot be repeated.

#!/bin/sh 

####################################################################################   Purpose:  Create a pwpolicy XML file based upon variables and options included below. 

##   Policy is applied and then file gets deleted. Use "sudo pwpolicy -u <user> -getaccountpolicies" 

##          to see it, and "sudo pwpolicy -u <user> -clearaccountpolicies" to clear it. 

##    Usage:   Edit variables in Variable flowerbox below. 

##          Then run as a policy from Casper, or standalone as root. 

#################################################################################  

# Get logged-in user and assign it to a variable 

LOGGEDINUSER=$(ls -l /dev/console | awk '{print $3}') 

echo "LOGGEDINUSER is: $LOGGEDINUSER" 

 

############################################################################## 

################################################# 

# Variables for script and commands generated below. 

# Edit as necessary for your own password policy. 

  

MAX_FAILED=10                            # 10 max failed logins before locking 

LOCKOUT=300                                # 5min lockout 

PW_EXPIRE=90                              # 90 days password expiration 

MIN_LENGTH=8                            # at least 8 chars for password 

MIN_NUMERIC=1                         # at least 1 number in password 

MIN_ALPHA_LOWER=1               # at least 1 lower case letter in password 

MIN_UPPER_ALPHA=1               # at least 1 upper case letter in password 

MIN_SPECIAL_CHAR=1              # at least one special character in password 

PW_HISTORY=10                        # remember last 10 passwords 

  

#exemptAccount1="admin"          # Insert the account you want to exempt in place of “admin” 

##################################################### 

############################################################################## 

  

############## Create pwpolicy.plist in /private/var/tmp 

 

#MAX_FAILED before LOCKOUT – Maximum failed attempts before device locks 

echo "<dict> 

<key>policyCategoryAuthentication</key> 

  <array> 

   <dict> 

    <key>policyContent</key> 

     <string>(policyAttributeFailedAuthentications < policyAttributeMaximumFailedAuthentications) OR (policyAttributeCurrentTime > (policyAttributeLastFailedAuthenticationTime + autoEnableInSeconds))</string> 

    <key>policyIdentifier</key> 

     <string>Authentication Lockout</string> 

    <key>policyParameters</key> 

  <dict> 

  <key>autoEnableInSeconds</key> 

   <integer>$LOCKOUT</integer> 

   <key>policyAttributeMaximumFailedAuthentications</key> 

   <integer>$MAX_FAILED</integer> 

  </dict> 

</dict> 

</array> 

  

#PW_EXPIRE - Number of days after which password needs to be changed 

<key>policyCategoryPasswordChange</key> 

  <array> 

   <dict> 

    <key>policyContent</key> 

     <string>policyAttributeCurrentTime > policyAttributeLastPasswordChangeTime + (policyAttributeExpiresEveryNDays * 24 * 60 * 60)</string> 

    <key>policyIdentifier</key> 

     <string>Change every $PW_EXPIRE days</string> 

    <key>policyParameters</key> 

    <dict> 

     <key>policyAttributeExpiresEveryNDays</key> 

      <integer>$PW_EXPIRE</integer> 

    </dict> 

   </dict> 

  </array> 

  

 #MIN_LENGTH – Minimum length of Password 

  <key>policyCategoryPasswordContent</key> 

<array> 

  <dict> 

   <key>policyContent</key> 

    <string>policyAttributePassword matches '.{$MIN_LENGTH,}+'</string> 

   <key>policyIdentifier</key> 

    <string>Has at least $MIN_LENGTH characters</string> 

   <key>policyParameters</key> 

   <dict> 

    <key>minimumLength</key> 

     <integer>$MIN_LENGTH</integer> 

   </dict> 

  </dict> 

  

 #MIN_NUMERIC – Minimum numbers in password 

  <dict> 

   <key>policyContent</key> 

    <string>policyAttributePassword matches '(.*[0-9].*){$MIN_NUMERIC,}+'</string> 

   <key>policyIdentifier</key> 

    <string>Has a number</string> 

   <key>policyParameters</key> 

   <dict> 

   <key>minimumNumericCharacters</key> 

    <integer>$MIN_NUMERIC</integer> 

   </dict> 

  </dict> 

  

 #MIN_ALPHA_LOWER – Minimum lowercase alphabets in password 

  <dict> 

   <key>policyContent</key> 

    <string>policyAttributePassword matches '(.*[a-z].*){$MIN_ALPHA_LOWER,}+'</string> 

   <key>policyIdentifier</key> 

    <string>Has a lower case letter</string> 

   <key>policyParameters</key> 

   <dict> 

   <key>minimumAlphaCharactersLowerCase</key> 

    <integer>$MIN_ALPHA_LOWER</integer> 

   </dict> 

  </dict> 

  

 #MIN_UPPER_ALPHA – Minimum uppercase alphabets in password 

  <dict> 

   <key>policyContent</key> 

    <string>policyAttributePassword matches '(.*[A-Z].*){$MIN_UPPER_ALPHA,}+'</string> 

   <key>policyIdentifier</key> 

    <string>Has an upper case letter</string> 

   <key>policyParameters</key> 

   <dict> 

   <key>minimumAlphaCharacters</key> 

    <integer>$MIN_UPPER_ALPHA</integer> 

   </dict> 

  </dict> 

  

 #MIN_SPECIAL_CHAR – Minimum special characters in password 

  <dict> 

   <key>policyContent</key> 

    <string>policyAttributePassword matches '(.*[^a-zA-Z0-9].*){$MIN_SPECIAL_CHAR,}+'</string> 

   <key>policyIdentifier</key> 

    <string>Has a special character</string> 

   <key>policyParameters</key> 

   <dict> 

   <key>minimumSymbols</key> 

    <integer>$MIN_SPECIAL_CHAR</integer> 

   </dict> 

  </dict> 

  

 #PW_HISTORY – Number of old passwords that cannot be used 

  <dict> 

   <key>policyContent</key> 

    <string>none policyAttributePasswordHashes in policyAttributePasswordHistory</string> 

   <key>policyIdentifier</key> 

    <string>Does not match any of last $PW_HISTORY passwords</string> 

   <key>policyParameters</key> 

   <dict> 

    <key>policyAttributePasswordHistoryDepth</key> 

     <integer>$PW_HISTORY</integer> 

   </dict> 

  </dict> 

  

</array> 

</dict>" > /private/var/tmp/pwpolicy.plist 

################ End of pwpolicy.plist generation script 

  

#Check for non-admin account before deploying policy 

if [ "$LOGGEDINUSER" != "$exemptAccount1" ]; then 

  

  chown $LOGGEDINUSER:staff /private/var/tmp/pwpolicy.plist 

  chmod 644 /private/var/tmp/pwpolicy.plist 

  

  # Clear account policy before loading a new one 

  pwpolicy -u $LOGGEDINUSER -clearaccountpolicies  

  pwpolicy -u $LOGGEDINUSER -setaccountpolicies /private/var/tmp/pwpolicy.plist 

  

elif [ "$LOGGEDINUSER" == "$exemptAccount1" ]; then 

   echo "Currently $exemptAccount1 is logged in and the password policy was NOT set. This script can only be run if the standard computer user is logged in." 

   rm -f /private/var/tmp/pwpolicy.plist 

   exit 1 

fi 

  

# clear account policy before loading a new one 

pwpolicy -clearaccountpolicies 

pwpolicy -setaccountpolicies /private/var/tmp/pwpolicy.plist 
  

#delete staged pwpolicy.plist 

rm -f /private/var/tmp/pwpolicy.plist 

echo "Password policy successfully applied. Run "sudo pwpolicy -getaccountpolicies" to see it." 

exit 0

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300

301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321

322

323

324

325

326

327

328

329

330

331

332

333

334

335

336

337

338

339

340

341

342

343

344

345

346

347

348

#!/bin/sh

#################################################################################### Purpose: Create a pwpolicy XML file based upon variables and options included below.

## Policy is applied and then file gets deleted. Use "sudo pwpolicy -u <user> -getaccountpolicies"

## to see it, and "sudo pwpolicy -u <user> -clearaccountpolicies" to clear it.

## Usage: Edit variables in Variable flowerbox below.

## Then run as a policy from Casper, or standalone as root.

#################################################################################

# Get logged-in user and assign it to a variable

LOGGEDINUSER=$(ls -l /dev/console | awk '{print $3}')

echo "LOGGEDINUSER is: $LOGGEDINUSER"

##############################################################################

#################################################

# Variables for script and commands generated below.

# Edit as necessary for your own password policy.

MAX_FAILED=10 # 10 max failed logins before locking

LOCKOUT=300 # 5min lockout

PW_EXPIRE=90 # 90 days password expiration

MIN_LENGTH=8 # at least 8 chars for password

MIN_NUMERIC=1 # at least 1 number in password

MIN_ALPHA_LOWER=1 # at least 1 lower case letter in password

MIN_UPPER_ALPHA=1 # at least 1 upper case letter in password

MIN_SPECIAL_CHAR=1 # at least one special character in password

PW_HISTORY=10 # remember last 10 passwords

#exemptAccount1="admin" # Insert the account you want to exempt in place of “admin”

#####################################################

##############################################################################

############## Create pwpolicy.plist in /private/var/tmp

#MAX_FAILED before LOCKOUT – Maximum failed attempts before device locks

echo "<dict>

<key>policyCategoryAuthentication</key>

<array>

<dict>

<key>policyContent</key>

<string>(policyAttributeFailedAuthentications < policyAttributeMaximumFailedAuthentications) OR (policyAttributeCurrentTime > (policyAttributeLastFailedAuthenticationTime + autoEnableInSeconds))</string>

<key>policyIdentifier</key>

<string>Authentication Lockout</string>

<key>policyParameters</key>

<dict>

<key>autoEnableInSeconds</key>

<integer>$LOCKOUT</integer>

<key>policyAttributeMaximumFailedAuthentications</key>

<integer>$MAX_FAILED</integer>

</dict>

</array>

#PW_EXPIRE - Number of days after which password needs to be changed

<key>policyCategoryPasswordChange</key>

<array>

<dict>

<key>policyContent</key>

<string>policyAttributeCurrentTime > policyAttributeLastPasswordChangeTime + (policyAttributeExpiresEveryNDays * 24 * 60 * 60)</string>

<key>policyIdentifier</key>

<string>Change every $PW_EXPIRE days</string>

<key>policyParameters</key>

<dict>

<key>policyAttributeExpiresEveryNDays</key>

<integer>$PW_EXPIRE</integer>

</dict>

</array>

#MIN_LENGTH – Minimum length of Password

<key>policyCategoryPasswordContent</key>

<array>

<dict>

<key>policyContent</key>

<string>policyAttributePassword matches '.{$MIN_LENGTH,}+'</string>

<key>policyIdentifier</key>

<string>Has at least $MIN_LENGTH characters</string>

<key>policyParameters</key>

<dict>

<key>minimumLength</key>

<integer>$MIN_LENGTH</integer>

</dict>

#MIN_NUMERIC – Minimum numbers in password

<dict>

<key>policyContent</key>

<string>policyAttributePassword matches '(.*[0-9].*){$MIN_NUMERIC,}+'</string>

<key>policyIdentifier</key>

<string>Has a number</string>

<key>policyParameters</key>

<dict>

<key>minimumNumericCharacters</key>

<integer>$MIN_NUMERIC</integer>

</dict>

#MIN_ALPHA_LOWER – Minimum lowercase alphabets in password

<dict>

<key>policyContent</key>

<string>policyAttributePassword matches '(.*[a-z].*){$MIN_ALPHA_LOWER,}+'</string>

<key>policyIdentifier</key>

<string>Has a lower case letter</string>

<key>policyParameters</key>

<dict>

<key>minimumAlphaCharactersLowerCase</key>

<integer>$MIN_ALPHA_LOWER</integer>

</dict>

#MIN_UPPER_ALPHA – Minimum uppercase alphabets in password

<dict>

<key>policyContent</key>

<string>policyAttributePassword matches '(.*[A-Z].*){$MIN_UPPER_ALPHA,}+'</string>

<key>policyIdentifier</key>

<string>Has an upper case letter</string>

<key>policyParameters</key>

<dict>

<key>minimumAlphaCharacters</key>

<integer>$MIN_UPPER_ALPHA</integer>

</dict>

#MIN_SPECIAL_CHAR – Minimum special characters in password

<dict>

<key>policyContent</key>

<string>policyAttributePassword matches '(.*[^a-zA-Z0-9].*){$MIN_SPECIAL_CHAR,}+'</string>

<key>policyIdentifier</key>

<string>Has a special character</string>

<key>policyParameters</key>

<dict>

<key>minimumSymbols</key>

<integer>$MIN_SPECIAL_CHAR</integer>

</dict>

#PW_HISTORY – Number of old passwords that cannot be used

<dict>

<key>policyContent</key>

<string>none policyAttributePasswordHashes in policyAttributePasswordHistory</string>

<key>policyIdentifier</key>

<string>Does not match any of last $PW_HISTORY passwords</string>

<key>policyParameters</key>

<dict>

<key>policyAttributePasswordHistoryDepth</key>

<integer>$PW_HISTORY</integer>

</dict>

</array>

</dict>" > /private/var/tmp/pwpolicy.plist

################ End of pwpolicy.plist generation script

#Check for non-admin account before deploying policy

if [ "$LOGGEDINUSER" != "$exemptAccount1" ]; then

chown $LOGGEDINUSER:staff /private/var/tmp/pwpolicy.plist

chmod 644 /private/var/tmp/pwpolicy.plist

# Clear account policy before loading a new one

pwpolicy -u $LOGGEDINUSER -clearaccountpolicies

pwpolicy -u $LOGGEDINUSER -setaccountpolicies /private/var/tmp/pwpolicy.plist

elif [ "$LOGGEDINUSER" == "$exemptAccount1" ]; then

echo "Currently $exemptAccount1 is logged in and the password policy was NOT set. This script can only be run if the standard computer user is logged in."

rm -f /private/var/tmp/pwpolicy.plist

exit 1

# clear account policy before loading a new one

pwpolicy -clearaccountpolicies

pwpolicy -setaccountpolicies /private/var/tmp/pwpolicy.plist

#delete staged pwpolicy.plist

rm -f /private/var/tmp/pwpolicy.plist

echo "Password policy successfully applied. Run "sudo pwpolicy -getaccountpolicies" to see it."

exit 0

Warning:

Updates to password restrictions must be thoroughly evaluated in a test environment. Configuration mistakes may block password change and local user creation operations and lock out all local users, including administrators.

Notes:

It is recommended to manually validate the script execution on a system before executing the action in bulk.
Hexnode will not be responsible for any damage/loss to the system on the behavior of the script.

Need more help?

Raise a Ticket

Ask Community

Chat With us