Prevent networksetup from asking password

Question

I have a little app that I use to change proxies on my Mac. It uses the networksetup command to set the proxy settings, and that worked fine on Lion. On Mountain Lion though, it asks the admin password every single time I change the proxy settings.

networksetup is trying to modify the system network configuration. Type your password to allow this.

Is there any way to prevent this from happening? Or is there a better way to change the proxy settings in Cocoa? On Lion the system remembered when I put the password in, so I had to authenticate only after reboots.

I also noticed that in Chrome, the Proxy Switchy plugin suffers from the same behaviour. It says

scutil is trying to modify the system network configuration. Type your password to allow this.

Solution 1

Use sudo to accomplish this by adding a passwordless rule for the user you want to be able to execute this command.

• Run visudo to launch an editor to modify the /etc/sudoers file

  visudo -f /etc/sudoers
  

• At the end of the file, add the line

  $USERNAME ALL=(root) NOPASSWD: /usr/sbin/networksetup
  

Where $USERNAME is, put the actual username you want to provide nopassword access to the networksetup command.

• Save the file

• Test it as your user by running

  /usr/bin/sudo /usr/sbin/networksetup -version
  

which will echo a version message if it's set up correctly, or prompt for a password if you've made a mistake.

This is a much safer route because it limits who can run the command as root to a specific user, setting the networksetup binary itself suid root means anyone who logs into the system could modify your network configuration. OSX is a multiuser operating system, and it should be treated like one.

If you're really paranoid, make sure you use the full path when calling /usr/bin/sudo as well.

Solution 2

You can set permission suid to /usr/sbin/networksetup and then networksetup will run with root permission, so you don't need to input password anymore.

sudo chmod u+s /usr/sbin/networksetup

About suid: http://www.linuxnix.com/2011/12/suid-set-suid-linuxunix.html

Comments

[SirDarius]

You misunderstood the question, what you are talking about is about giving a password to networksetup for commands that expect one. The OP's issue is that networksetup needs to be run by user with admin privileges. It's not even networksetup that asks for a password here, but the authentication manager.

[sorin]

This seemed to work on OS X 10.8 but I am afraid that if I repair permissions using Disk Util this fix will go away.

[Sean]

This gives me the error cp: /Library/Preferences/SystemConfiguration/preferences.plist.o‌​ld: Permission denied

[synthesizerpatel]

Don't set binaries suid - it's bad practice and is why sudo exists in the first place. I've added an sudo based answer for this question to show the more security minded solution for this problem.

[dcnicholls]

More information, please. I tried the above (let's assume my admin user name is 'fred') adding {fred ALL=(root) NOPASSWD: /usr/sbin/networksetup} and got a long series of errors with the test (NB sbin not bin). How should I format the command?

[nanoamp]

I've edited the answer to fix the path, and make the test clearer. If you call networksetup without any parameters then you would get a long page of usage tips. But that does prove that it works without a password.

[thefonso]

These instructions produce THIS error now "sudo: parse error in /etc/sudoers near line 48 sudo: no valid sudoers sources found, quitting" How do we edit the file Now?

[stevendaniels]

Use visudo to edit the file. It will ensure the file doesn't have any errors.

[tdc]

I've gone ahead and tried this but I'm still getting the prompt continuously (trying to install Private Internet Access client on OSX), despite the -version check working as expected. For what it's worth I'm on El Capitan - did the location of networksetup change?

[Jeef]

sudo doesn't fix the error however - but the new UAC mode in 10.10 and 10.11 removes it.

[I0_ol]

This doesn't seem to be working anymore. I'm assuming because of SIP.

[JBis]

Link broken please fix