25

I have a little app that I use to change proxies on my Mac. It uses the networksetup command to set the proxy settings, and that worked fine on Lion. On Mountain Lion though, it asks the admin password every single time I change the proxy settings.

networksetup is trying to modify the system network configuration. Type your password to allow this.

Is there any way to prevent this from happening? Or is there a better way to change the proxy settings in Cocoa? On Lion the system remembered when I put the password in, so I had to authenticate only after reboots.

I also noticed that in Chrome, the Proxy Switchy plugin suffers from the same behaviour. It says

scutil is trying to modify the system network configuration. Type your password to allow this.

3 Answers 3

13

Use sudo to accomplish this by adding a passwordless rule for the user you want to be able to execute this command.

  • Run visudo to launch an editor to modify the /etc/sudoers file

    visudo -f /etc/sudoers
    
  • At the end of the file, add the line

    $USERNAME ALL=(root) NOPASSWD: /usr/sbin/networksetup
    

Where $USERNAME is, put the actual username you want to provide nopassword access to the networksetup command.

  • Save the file
  • Test it as your user by running

    /usr/bin/sudo /usr/sbin/networksetup -version
    

which will echo a version message if it's set up correctly, or prompt for a password if you've made a mistake.

This is a much safer route because it limits who can run the command as root to a specific user, setting the networksetup binary itself suid root means anyone who logs into the system could modify your network configuration. OSX is a multiuser operating system, and it should be treated like one.

If you're really paranoid, make sure you use the full path when calling /usr/bin/sudo as well.

6
  • More information, please. I tried the above (let's assume my admin user name is 'fred') adding {fred ALL=(root) NOPASSWD: /usr/sbin/networksetup} and got a long series of errors with the test (NB sbin not bin). How should I format the command?
    – dcnicholls
    Oct 4, 2014 at 11:06
  • I've edited the answer to fix the path, and make the test clearer. If you call networksetup without any parameters then you would get a long page of usage tips. But that does prove that it works without a password.
    – nanoamp
    Oct 23, 2014 at 7:45
  • These instructions produce THIS error now "sudo: parse error in /etc/sudoers near line 48 sudo: no valid sudoers sources found, quitting" How do we edit the file Now?
    – thefonso
    Jun 29, 2015 at 16:26
  • Use visudo to edit the file. It will ensure the file doesn't have any errors. Jul 10, 2015 at 3:39
  • I've gone ahead and tried this but I'm still getting the prompt continuously (trying to install Private Internet Access client on OSX), despite the -version check working as expected. For what it's worth I'm on El Capitan - did the location of networksetup change?
    – tdc
    Jan 2, 2016 at 19:20
7

You can set permission suid to /usr/sbin/networksetup and then networksetup will run with root permission, so you don't need to input password anymore.

sudo chmod u+s /usr/sbin/networksetup

About suid: http://www.linuxnix.com/2011/12/suid-set-suid-linuxunix.html

5
  • 1
    This seemed to work on OS X 10.8 but I am afraid that if I repair permissions using Disk Util this fix will go away.
    – sorin
    Jul 10, 2013 at 9:14
  • This gives me the error cp: /Library/Preferences/SystemConfiguration/preferences.plist.old: Permission denied
    – Sean
    Oct 31, 2013 at 23:19
  • 1
    Don't set binaries suid - it's bad practice and is why sudo exists in the first place. I've added an sudo based answer for this question to show the more security minded solution for this problem. Nov 21, 2013 at 1:21
  • sudo doesn't fix the error however - but the new UAC mode in 10.10 and 10.11 removes it.
    – Jeef
    Jan 18, 2016 at 19:29
  • Link broken please fix Aug 26, 2018 at 0:48
0

I've been trying to figure this out as well. I noticed the man page mentions this:

Any flag that takes a password will accept "-" in place of the password to indicate it should read the password from stdin.

Not sure quite how to use it but it seems possible...

1
  • 1
    You misunderstood the question, what you are talking about is about giving a password to networksetup for commands that expect one. The OP's issue is that networksetup needs to be run by user with admin privileges. It's not even networksetup that asks for a password here, but the authentication manager.
    – SirDarius
    Jun 9, 2013 at 9:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.