Updating Keychains with Addigy – Addigy

Addigy provides some fantastic tools for updating login passwords, but anytime a password is changed in macOS it will break the sync between the user's keychain and the login password (except the System Preferences GUI method which includes the keychain update). When a keychain isn't synced, users will not be able to remotely connect to the device using Addigy Remote Control or ScreenConnect. This is because there is a System dialog-box that appears on login to fix the Login Keychain that cannot be bypassed remotely.

Updating the Keychain

There are a couple of methods for updating the keychain remotely. The easiest method is probably to run a variant of this command from Devices -> Run Command.

# Replace the $variables with your own information.
security set-keychain-password -o "$oldPassword" -p "$newPassword" "/Users/$username/Library/Keychains/login.keychain-db"

Of course, this method requires you to know the old password used for the account. In the case where that information is not available, a new login keychain can be created for the user.

# Replace the $variables with your own information.

# Make a copy of the old login keychain.
"mv /Users/$username/Library/Keychains/login.keychain-db ""/Users/$username/Library/Keychains/old-login-$(date +"%Y-%m-%d-%H-%M").keychain-db"

# Create a new keychain
security create-keychain -p "$password" "/Users/$username/Library/Keychains/login.keychain-db"

Note: OS X 10.11 El Capitan and older versions of OS X do not use the ".keychain-db" extension. They use the ".keychain" extension.

Security Implications

Per Apple's man page documentation "use of the -p option is insecure". This is because the password will be in plain-text in the Bash history of the device. This becomes slightly less risky when considering that this will be the root user's Bash history which is obscure and difficult to access. That being said, the risks should be considered when performing these commands.

External References

There may be other methods for modifying the user's keychains. You can read more about the security command in Apple's documentation here--security(1) Mac OS X Manual Page - Apple Developer--or just by typing man security into your Bash terminal.