Password Enforcement on macOS

Enforce enterprise-grade password policies and security standards across your Roundfleet devices using comprehensive command-line tools and security frameworks. This tutorial covers password policy implementation, compliance monitoring, and automated enforcement systems.

Understanding macOS Password Security

macOS provides multiple layers of password security:

Password Policies - Complexity, length, and rotation requirements
Screen Lock Security - Automatic locking and unlock requirements
Secure Token Management - FileVault and encryption support
Account Security - User privilege and access controls

Password Policy Configuration

Basic Password Requirements

#!/bin/bash

# Set basic password policy using pwpolicy
configure_password_policy() {
    # Configure password complexity requirements
    sudo pwpolicy -a diradmin -u $USER -setpolicy "minChars=8 requiresAlpha requiresNumeric"
    
    # Set password history (prevent reuse of last 5 passwords)
    sudo pwpolicy -a diradmin -u $USER -setpolicy "usingHistory=5"
    
    # Set password expiration (90 days)
    sudo pwpolicy -a diradmin -u $USER -setpolicy "maxMinutesUntilChangePassword=129600"
    
    echo "Basic password policy configured successfully"
}

configure_password_policy

Advanced Security Settings

#!/bin/bash

# Configure advanced password and security settings
configure_advanced_security() {
    echo "=== Advanced Security Configuration ==="
    
    # Enable password requirement for wake from sleep
    osascript -e 'tell application "System Events" to set require password to wake of security preferences to true'
    
    # Set immediate password requirement
    defaults write com.apple.screensaver askForPassword -int 1
    defaults write com.apple.screensaver askForPasswordDelay -int 0
    
    # Configure account lockout policy
    sudo pwpolicy -a diradmin -setpolicy "maxFailedLoginAttempts=5"
    
    # Enable automatic logout after inactivity
    sudo defaults write /Library/Preferences/.GlobalPreferences com.apple.autologout.AutoLogOutDelay -int 3600
    
    echo "Advanced security settings configured"
}

configure_advanced_security

Screen Lock Enforcement

Automatic Screen Lock

#!/bin/bash

# Configure automatic screen lock settings
configure_screen_lock() {
    local lock_delay="${1:-300}" # Default 5 minutes
    
    echo "Configuring screen lock with ${lock_delay} second delay"
    
    # Set screen saver activation time
    defaults -currentHost write com.apple.screensaver idleTime -int "$lock_delay"
    
    # Enable password requirement for screen saver
    defaults write com.apple.screensaver askForPassword -int 1
    defaults write com.apple.screensaver askForPasswordDelay -int 0
    
    # Configure energy saver settings
    sudo pmset -a displaysleep 5    # Display sleep after 5 minutes
    sudo pmset -a sleep 30          # System sleep after 30 minutes
    
    # Kill screen saver preferences to apply changes
    killall ScreenSaverEngine 2>/dev/null || true
    
    echo "Screen lock configured successfully"
}

# Usage: configure_screen_lock [delay_in_seconds]
configure_screen_lock 300

Immediate Lock Enforcement

#!/bin/bash

# Force immediate screen lock
force_screen_lock() {
    echo "Forcing immediate screen lock..."
    
    # Multiple methods to ensure lock
    /System/Library/CoreServices/Menu\ Extras/User.menu/Contents/Resources/CGSession -suspend
    
    # Alternative method using pmset
    pmset displaysleepnow
    
    # Activate screen saver as backup
    /System/Library/Frameworks/ScreenSaver.framework/Resources/ScreenSaverEngine.app/Contents/MacOS/ScreenSaverEngine -background &
    
    echo "Screen locked successfully"
}

force_screen_lock

Password Complexity Enforcement

Complex Password Validation

#!/bin/bash

# Validate password complexity
validate_password_complexity() {
    local password="$1"
    local min_length=8
    local errors=0
    
    echo "=== Password Complexity Validation ==="
    
    # Check minimum length
    if [[ ${#password} -lt $min_length ]]; then
        echo "❌ Password must be at least $min_length characters"
        ((errors++))
    else
        echo "✅ Length requirement met"
    fi
    
    # Check for uppercase letter
    if [[ ! "$password" =~ [A-Z] ]]; then
        echo "❌ Password must contain at least one uppercase letter"
        ((errors++))
    else
        echo "✅ Uppercase letter found"
    fi
    
    # Check for lowercase letter
    if [[ ! "$password" =~ [a-z] ]]; then
        echo "❌ Password must contain at least one lowercase letter"
        ((errors++))
    else
        echo "✅ Lowercase letter found"
    fi
    
    # Check for number
    if [[ ! "$password" =~ [0-9] ]]; then
        echo "❌ Password must contain at least one number"
        ((errors++))
    else
        echo "✅ Number found"
    fi
    
    # Check for special character
    if [[ ! "$password" =~ [^a-zA-Z0-9] ]]; then
        echo "❌ Password must contain at least one special character"
        ((errors++))
    else
        echo "✅ Special character found"
    fi
    
    # Check for common patterns
    if [[ "$password" =~ (123|abc|password|qwerty) ]]; then
        echo "❌ Password contains common patterns"
        ((errors++))
    else
        echo "✅ No common patterns detected"
    fi
    
    if [[ $errors -eq 0 ]]; then
        echo "✅ Password meets all complexity requirements"
        return 0
    else
        echo "❌ Password failed $errors complexity checks"
        return 1
    fi
}

# Example usage (do not use in production with actual passwords)
# validate_password_complexity "TestPassword123!"

Password Generation

#!/bin/bash

# Generate secure passwords
generate_secure_password() {
    local length="${1:-12}"
    local include_symbols="${2:-true}"
    
    echo "=== Secure Password Generation ==="
    
    if [[ "$include_symbols" == "true" ]]; then
        # Generate password with symbols
        local charset='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*'
    else
        # Generate alphanumeric password
        local charset='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'
    fi
    
    # Generate random password
    local password=$(openssl rand -base64 32 | tr -d "=+/" | cut -c1-${length})
    
    # Ensure complexity requirements
    password="${password:0:$((length-4))}A1@z"
    
    echo "Generated password length: ${#password}"
    echo "Password complexity verified"
    
    # Validate the generated password
    if validate_password_complexity "$password"; then
        echo "✅ Generated password meets all requirements"
    fi
}

generate_secure_password 12 true

User Account Management

Password Reset and Management

#!/bin/bash

# User account password management
manage_user_passwords() {
    local username="$1"
    local action="$2"
    
    echo "=== User Password Management ==="
    echo "Managing password for user: $username"
    
    case "$action" in
        "reset")
            # Force password reset on next login
            sudo pwpolicy -a diradmin -u "$username" -setpolicy "newPasswordRequired=1"
            echo "Password reset required for $username on next login"
            ;;
        "expire")
            # Expire password immediately
            sudo pwpolicy -a diradmin -u "$username" -setpolicy "passwordLastSetTime=0"
            echo "Password expired for $username"
            ;;
        "unlock")
            # Unlock account after failed attempts
            sudo pwpolicy -a diradmin -u "$username" -clearfailedlogins
            echo "Account unlocked for $username"
            ;;
        "status")
            # Check password status
            sudo pwpolicy -a diradmin -u "$username" -getpolicy
            ;;
        *)
            echo "Usage: manage_user_passwords <username> <reset|expire|unlock|status>"
            return 1
            ;;
    esac
}

# Example usage
# manage_user_passwords "johndoe" "status"

Secure Token Management

#!/bin/bash

# Add secure token to user account
add_secure_token() {
    local admin_user="$1"
    local admin_password="$2"
    local target_user="$3"
    local target_password="$4"
    
    echo "=== Secure Token Management ==="
    
    # Check macOS version compatibility
    local macos_version=$(sw_vers -productVersion)
    echo "macOS Version: $macos_version"
    
    # Check if target user already has secure token
    if sysadminctl -secureTokenStatus "$target_user" 2>&1 | grep -q "ENABLED"; then
        echo "✅ $target_user already has SecureToken"
        return 0
    fi
    
    # Check if admin user has secure token
    if sysadminctl -secureTokenStatus "$admin_user" 2>&1 | grep -q "DISABLED"; then
        echo "❌ Admin user $admin_user does not have SecureToken"
        return 1
    fi
    
    echo "Adding SecureToken to $target_user..."
    
    # Add secure token
    if sysadminctl -adminUser "$admin_user" \
                   -adminPassword "$admin_password" \
                   -secureTokenOn "$target_user" \
                   -password "$target_password"; then
        echo "✅ SecureToken added successfully to $target_user"
    else
        echo "❌ Failed to add SecureToken to $target_user"
        return 1
    fi
}

# Example usage (replace with actual credentials in secure environment)
# add_secure_token "admin" "admin_pass" "user" "user_pass"

Enterprise Password Management System

#!/bin/bash

# Roundfleet Enterprise Password Management System
# Comprehensive password policy enforcement and monitoring

# Configuration
LOG_FILE="/var/log/roundfleet_password_security.log"
POLICY_CONFIG="/etc/roundfleet/password_policy.conf"
COMPLIANCE_REPORT="/var/log/roundfleet_password_compliance.json"

# Logging function
log_action() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" | tee -a "$LOG_FILE"
}

# Load password policy configuration
load_policy_config() {
    if [[ -f "$POLICY_CONFIG" ]]; then
        source "$POLICY_CONFIG"
    else
        # Default values
        MIN_PASSWORD_LENGTH=8
        MAX_PASSWORD_AGE=90
        PASSWORD_HISTORY=5
        MAX_FAILED_ATTEMPTS=5
        LOCK_TIMEOUT=300
        COMPLEXITY_REQUIRED=true
    fi
}

# Check password compliance for all users
check_password_compliance() {
    log_action "Starting password compliance check"
    
    local compliance_data='{"timestamp":"'$(date -u +%Y-%m-%dT%H:%M:%SZ)'","users":[]}'
    local non_compliant_count=0
    
    # Get all local users
    local users=$(dscl . list /Users | grep -v '^_' | grep -v 'daemon\|nobody\|root')
    
    while IFS= read -r username; do
        if [[ -n "$username" ]]; then
            log_action "Checking compliance for user: $username"
            
            local user_data='{"username":"'$username'","compliant":true,"issues":[]}'
            local issues=()
            
            # Check password age
            local last_change=$(dscl . read "/Users/$username" passwordPolicyOptions | grep -o 'passwordLastSetTime</key><real>[0-9.]*' | cut -d'>' -f2 || echo "0")
            if [[ -n "$last_change" && "$last_change" != "0" ]]; then
                local age_days=$(( ($(date +%s) - ${last_change%.*}) / 86400 ))
                if [[ $age_days -gt $MAX_PASSWORD_AGE ]]; then
                    issues+=("Password expired ($age_days days old)")
                fi
            fi
            
            # Check account lockout status
            local failed_attempts=$(dscl . read "/Users/$username" | grep -c "authenticationHint" || echo "0")
            
            # Check secure token status
            if ! sysadminctl -secureTokenStatus "$username" 2>&1 | grep -q "ENABLED"; then
                issues+=("No SecureToken")
            fi
            
            # Update compliance data
            if [[ ${#issues[@]} -gt 0 ]]; then
                user_data='{"username":"'$username'","compliant":false,"issues":["'$(IFS='","'; echo "${issues[*]}")'"]}' 
                ((non_compliant_count++))
            fi
            
            # Add to compliance report
            compliance_data=$(echo "$compliance_data" | jq --argjson user "$user_data" '.users += [$user]')
        fi
    done <<< "$users"
    
    # Save compliance report
    echo "$compliance_data" | jq . > "$COMPLIANCE_REPORT"
    
    log_action "Compliance check completed: $non_compliant_count non-compliant users found"
    
    if [[ $non_compliant_count -gt 0 ]]; then
        log_action "⚠️ Password compliance issues detected"
        return 1
    else
        log_action "✅ All users are password compliant"
        return 0
    fi
}

# Enforce password policies
enforce_password_policies() {
    log_action "Starting password policy enforcement"
    
    # Configure system-wide password policies
    log_action "Applying system-wide password policies"
    
    # Set password complexity requirements
    if [[ "$COMPLEXITY_REQUIRED" == "true" ]]; then
        sudo pwpolicy -a diradmin -setglobalpolicy "minChars=$MIN_PASSWORD_LENGTH requiresAlpha requiresNumeric"
        log_action "Password complexity requirements set"
    fi
    
    # Configure account lockout
    sudo pwpolicy -a diradmin -setglobalpolicy "maxFailedLoginAttempts=$MAX_FAILED_ATTEMPTS"
    log_action "Account lockout policy set to $MAX_FAILED_ATTEMPTS failed attempts"
    
    # Configure password history
    sudo pwpolicy -a diradmin -setglobalpolicy "usingHistory=$PASSWORD_HISTORY"
    log_action "Password history set to $PASSWORD_HISTORY previous passwords"
    
    # Configure screen lock
    defaults write com.apple.screensaver askForPassword -int 1
    defaults write com.apple.screensaver askForPasswordDelay -int 0
    log_action "Screen lock password requirement enabled"
    
    # Set automatic screen lock
    defaults -currentHost write com.apple.screensaver idleTime -int "$LOCK_TIMEOUT"
    log_action "Automatic screen lock set to $LOCK_TIMEOUT seconds"
}

# Generate password compliance report
generate_compliance_report() {
    log_action "Generating password compliance report"
    
    if [[ -f "$COMPLIANCE_REPORT" ]]; then
        local total_users=$(jq '.users | length' "$COMPLIANCE_REPORT")
        local compliant_users=$(jq '.users | map(select(.compliant == true)) | length' "$COMPLIANCE_REPORT")
        local non_compliant_users=$(jq '.users | map(select(.compliant == false)) | length' "$COMPLIANCE_REPORT")
        
        echo "=== Password Compliance Report ==="
        echo "Report Generated: $(jq -r '.timestamp' "$COMPLIANCE_REPORT")"
        echo "Total Users: $total_users"
        echo "Compliant Users: $compliant_users"
        echo "Non-Compliant Users: $non_compliant_users"
        echo "Compliance Rate: $(( (compliant_users * 100) / total_users ))%"
        
        if [[ $non_compliant_users -gt 0 ]]; then
            echo ""
            echo "Non-Compliant Users:"
            jq -r '.users[] | select(.compliant == false) | "- " + .username + ": " + (.issues | join(", "))' "$COMPLIANCE_REPORT"
        fi
    else
        echo "No compliance report found. Run compliance check first."
    fi
}

# Automated password security tasks
run_security_maintenance() {
    log_action "=== Starting automated password security maintenance ==="
    
    # Load configuration
    load_policy_config
    
    # Check compliance
    check_password_compliance
    
    # Enforce policies
    enforce_password_policies
    
    # Generate report
    generate_compliance_report
    
    log_action "=== Password security maintenance completed ==="
}

# Main execution
main() {
    local action="${1:-maintenance}"
    
    case "$action" in
        "compliance")
            load_policy_config
            check_password_compliance
            ;;
        "enforce")
            load_policy_config
            enforce_password_policies
            ;;
        "report")
            generate_compliance_report
            ;;
        "maintenance")
            run_security_maintenance
            ;;
        *)
            echo "Usage: $0 [compliance|enforce|report|maintenance]"
            echo "  compliance - Check password compliance for all users"
            echo "  enforce    - Apply password policies"
            echo "  report     - Generate compliance report"
            echo "  maintenance - Run full maintenance cycle (default)"
            exit 1
            ;;
    esac
}

# Execute main function
main "$@"

Password Policy Configuration File

Create a configuration file for password policies:

#!/bin/bash

# Create password policy configuration
create_policy_config() {
    local config_dir="/etc/roundfleet"
    local config_file="$config_dir/password_policy.conf"
    
    # Create directory if it doesn't exist
    sudo mkdir -p "$config_dir"
    
    # Create configuration file
    sudo tee "$config_file" > /dev/null << 'EOF'
# Roundfleet Password Policy Configuration

# Password Requirements
MIN_PASSWORD_LENGTH=8
MAX_PASSWORD_LENGTH=128
REQUIRE_UPPERCASE=true
REQUIRE_LOWERCASE=true
REQUIRE_NUMBERS=true
REQUIRE_SPECIAL_CHARS=true

# Password Rotation
MAX_PASSWORD_AGE=90          # Days before password expires
PASSWORD_HISTORY=5           # Number of previous passwords to remember
EXPIRATION_WARNING_DAYS=14   # Days before expiration to warn user

# Account Security
MAX_FAILED_ATTEMPTS=5        # Failed login attempts before lockout
LOCKOUT_DURATION=1800        # Account lockout duration in seconds
AUTO_UNLOCK=true             # Automatically unlock after lockout duration

# Screen Security
LOCK_TIMEOUT=300             # Screen lock timeout in seconds
IMMEDIATE_LOCK=true          # Require password immediately after lock
SCREEN_SAVER_TIMEOUT=600     # Screen saver activation timeout

# Compliance
COMPLEXITY_REQUIRED=true     # Enforce password complexity
SECURE_TOKEN_REQUIRED=true   # Require SecureToken for all users
REGULAR_AUDITS=true          # Enable regular compliance audits
AUDIT_FREQUENCY=7            # Days between compliance audits

# Logging
ENABLE_LOGGING=true          # Enable security event logging
LOG_LEVEL="INFO"             # Log level: DEBUG, INFO, WARN, ERROR
LOG_RETENTION=30             # Days to retain log files
EOF

    echo "Password policy configuration created at: $config_file"
}

create_policy_config

Integration with Roundfleet Management

#!/bin/bash

# Roundfleet password management integration
roundfleet_password_integration() {
    echo "=== Roundfleet Password Management Integration ==="
    
    # Device registration
    local device_id=$(system_profiler SPHardwareDataType | grep "Hardware UUID" | awk '{print $3}')
    local hostname=$(hostname)
    
    echo "Device ID: $device_id"
    echo "Hostname: $hostname"
    
    # Report to Roundfleet API (placeholder)
    local api_endpoint="https://api.roundfleet.com/devices/$device_id/security"
    local report_data='{
        "device_id": "'$device_id'",
        "hostname": "'$hostname'",
        "timestamp": "'$(date -u +%Y-%m-%dT%H:%M:%SZ)'",
        "password_policy_status": "enforced",
        "compliance_check": "'$(date +%s)'",
        "security_level": "enterprise"
    }'
    
    echo "Security status reported to Roundfleet"
}

roundfleet_password_integration

Important Security Notes

Password Storage and Handling

Never log actual passwords in scripts or logs
Use secure credential management for administrative passwords
Implement proper encryption for any stored authentication data
Regular security audits of password policies and compliance

Best Practices

Test policies on development devices before fleet deployment
Gradual rollout of new password requirements
User communication about policy changes
Emergency procedures for account lockouts and password resets

Monitoring and Compliance

Regular audits of password compliance across the fleet
Automated alerts for policy violations
Reporting dashboard for security status
Integration with enterprise identity management systems

This enterprise password enforcement system provides comprehensive security management for Roundfleet devices while maintaining usability and compliance with enterprise security standards.

Tutorial

Aviso importante