Updating Keychains with Addigy – Addigy

Addigy provides some fantastic tools for updating login passwords, but anytime a password is changed in macOS, it will break the sync between the user's keychain and the login password (except the System Preferences GUI method, which includes the keychain update). When a keychain isn't synced, users cannot remotely connect to the device using Addigy Live Desktop or Splashtop. This is because a System dialog box appears on login to fix the Login Keychain that cannot be bypassed remotely.

Updating the Keychain

There are a couple of methods for updating the keychain remotely. The easiest method is probably to run a variant of this command from Devices -> Run Command.

# Replace the $variables with your own information.
security set-keychain-password -o "$oldPassword" -p "$newPassword" "/Users/$username/Library/Keychains/login.keychain-db"

Of course, this method requires you to know the old password used for the account. When that information is unavailable, a new login keychain can be created for the user.

# Replace the $variables with your own information.

# Make a copy of the old login keychain.
"mv /Users/$username/Library/Keychains/login.keychain-db ""/Users/$username/Library/Keychains/old-login-$(date +"%Y-%m-%d-%H-%M").keychain-db"

# Create a new keychain
security create-keychain -p "$password" "/Users/$username/Library/Keychains/login.keychain-db"

Note: OS X 10.11 El Capitan and older versions of OS X do not use the ".keychain-db" extension. They use the ".keychain" extension.

Security Implications

Per Apple's man page documentation "use of the -p option is insecure". This is because the password will be in plain-text in the Bash history of the device. This becomes slightly less risky when considering that it will be the root user's Bash history which is obscure and difficult to access. That being said, the risks should be considered when performing these commands.

External References

There may be other methods for modifying the user's keychains. You can read more about the security command in Apple's documentation here--security(1) Mac OS X Manual Page - Apple Developer--or just by typing man security into your Bash terminal.