Function of Open Firmware Password

You can use the Open Firmware Password application to set up low-level password protection (Open Firmware Password Protection) with Mac OS X 10.1 and later. The Open Firmware Password application allows you to enable security features in Open Firmware. You can use it to prevent others from starting your computer using a CD or other disk with an operating system on it. You can use Firmware password protection to enhance access security to your computer.

When you set a Firmware password, it prevents others from starting up the computer from a volume other than the one you have chosen as the startup disk (chosen in the Startup Disk preference panel within the System Preferences.) Once security is enabled, you cannot startup from other devices such as an external FireWire disk, a CD-ROM drive, or another partition or disk inside the computer.

For Mac OS X 10.4 and higher

Download the Open Firmware Password Application from here

For Mac OS X 10.1 – 10.3.9

The Open Firmware Password Application Utility is located in the /Applications/Utilities/ folder on your software installation DVD. Please copy it to your machine.

Warning & Disclaimer

Enabling the Open Firmware password protection feature is done so at your own risk, the author of this article  will NOT be held accountable or responsible for whatever you do. Attempts to use firmware in a manner that is not explicitly endorsed by Apple may damage your computer’s logic board. Any repairs that are necessary because of this damage will not be covered under the terms of the Apple One-Year Limited Warranty, AppleCare Protection Plan, or other AppleCare agreement.

Also, updating the Open Firmware with security enabled has been reported to cause permanent password corruption (and the security-mode setting before the update stays). So disable password protection security before applying any Open Firmware update. 

Products Affected

eMac, iMac, Mac mini, Power Mac, PowerBook, MacBook, MacBook Pro, iBook, Mac OS X 10.1, Mac OS X 10.2, Mac OS X 10.3, Mac OS X 10.4, MacBook Air, Mac OS X 10.5

Computers compatible with Open Firmware Password Protection

Use of the Open Firmware Password Protection and the Open Firmware Password application requires an Apple computer that works with Open Firmware 4.1.7 or 4.1.8 or later, depending on the computer. To determine which version of Open Firmware is installed on your computer, open the Apple System Profiler and see the Production Information section. The Boot ROM version is also your computer’s Open Firmware version. If you have an earlier version, an update would be required. A list of the latest firmware updates for various models is available.

All Intel-based Macintosh computers support firmware password protection.

The following Apple computers can use the Open Firmware Password application:

1. iMac (Slot Loading) and later models of G3 iMac
2. iMac (Flat Panel) and later models of G4 iMac
3. iMac G5 and later models of G5 iMac
4. iBook – all models, both G3- and G4-based
5. eMac – all models
6. PowerBook (FireWire)
7. PowerBook G4 and later models of G4 PowerBook
8. Power Mac G4 (AGP Graphics) and later models of G4 Power Mac
9. Power Mac G4 Cube – all models
10. Power Mac G5 and later models of G5 Power Mac
11. Any Intel-based Mac

Features of Open Firmware Password Protection

When turned on using one of the PowerPC-based models listed above, Open Firmware Password Protection:

1. Blocks the ability to use the “C” key to start up from an optical disc.
2. Blocks the ability to use the “N” key to start up from a NetBoot server.
3. Blocks the ability to use the “T” key to start up in Target Disk Mode (on computers that offer this feature).
4. Blocks the ability to start up in Verbose mode by pressing the Command-V key combination during startup.
5. Block the ability to start up a system in Single-user mode by pressing the Command-S key combination during startup.
6. Blocks a reset of Parameter RAM (PRAM) by pressing the Command-Option-P-R key combination during startup.
7. Requires the password to use the Startup Manager, accessed by pressing the Option key during startup (see below).



8. Requires the password to enter commands after starting up in Open Firmware, which is done by pressing the Command-Option-O-F key combination during startup.
9. Blocks the ability to start up in Safe Boot mode by pressing the Shift key during startup.
10. When turned on using an Intel-based Mac, Open Firmware Password Protection:
11. Blocks the ability to use the “C” key to start up from an optical disc.
12. Blocks the ability to use the “N” key to start up from a NetBoot server.
13. Blocks the ability to use the “T” key to start up in Target Disk Mode (on computers that offer this feature).
14. Blocks the ability to use the “D” key to start up from the Diagnostic volume of the Install DVD.
15. Blocks the ability to start up a system in Single-user mode by pressing the Command-S key combination during startup.
16. Blocks a reset of Parameter RAM (PRAM) by pressing the Command-Option-P-R key combination during startup.
17. Blocks the ability to start up in Verbose mode by pressing the Command-V key combination during startup.
18. Blocks the ability to start up in Safe Boot mode by pressing the Shift key during startup.
19. Requires the password to use the Startup Manager, accessed by pressing the Option key during startup (see below).

Note: Firmware password protection does not prevent someone with physical access to the computer from restarting it or turning it off.

Preparing a computer to take advantage of password protection

Open Firmware Password Protection can only effectively protect a computer that enjoys some degree of physical security. To maximize the effectiveness of the firmware password, do all of the following:

1. Use a secure password that contains both numerals and letters in the first eight characters.

2. In the Users control panel, Accounts pane of System Preferences, or Server Admin application (whichever applies to your computer), strictly limit Admin user status to trusted personnel.

3. Restrict physical access to the computer. Place the computer in a locked room, and lock the cover latch or use the security lock port.

4. Only allow trusted users to start up the computer in Mac OS 9, if applicable.

5. Make sure that you have selected the Mac OS X System folder for your startup device that you plan to protect.

6. If your startup device is correctly selected, you should be able to select it in Startup Disk preferences, close the preference pane, and not receive a dialog box prompting you to save the changes. If you do receive this dialog, saving the changes sets your startup device.

Important: If you reset the PRAM or Open Firmware, you need to reselect your startup device prior to resetting the Open Firmware Password.

Warning: The Open Firmware Password can be reset and changed by any one of the following (except MacBook Air):

1. By any administrator user, as designated in the Accounts preferences (or in Server Admin).

2. Via physical access to the inside of the computer.

3. When the computer is started up in Mac OS 9.

How to enable the Open Firmware Password

On any computer capable of firmware password protection (including Intel-based Macintosh computers), follow these steps:

1. For Mac OS X 10.1 to 10.3.9, download and install the Open Firmware Password application, which you can get here.

For Mac OS X 10.4.x, you must use the updated version that can be copied from the software installation disc (located at /Applications/Utilities/ on the disc).

For Mac OS X 10.5.x, start from the Leopard Install DVD and choose Firmware Password Utility from the Utilities menu, then skip to step 5.

2. Open the Open Firmware Password application.

3. Click the icon to authenticate. Enter an administrator username and password when prompted.

4. Click Change.

5. Click to select the checkbox for “Require password to change Open Firmware settings”, as shown below.

6. Type your password in the Password and Verify fields.

7. Click OK. A confirmation appears.

8. Click lock icon to prevent further changes.

9. Choose Quit from the application menu.

10. and Done !

Other Procedure (Not Recommended) from securemac.com

Enabling Password Protection

1) Boot into the Open Firmware. (Command + Option + O + F)

2) At the command prompt, type “password” (without the quotes, of course). You will be prompted to enter in the password you wish to use. Type your password, press the return key, retype your password again, and press return to verify that that the first password you typed is indeed the password you want. (Note: the password is stored in the “security-password” variable, but the contents of this variable is never shown via the “printenv” command.)

3) Type “setenv security-mode full” OR “setenv security-mode command” OR “setenv security-mode none“, depending on which level of security you wish.

4) Then type “reset-all” to restart the computer.

Disabling Password Protection

1) Boot into the Open Firmware. (Command + Option + O + F)

2) Type “setenv security-mode none” and press return.

3) Enter in the password at the password request prompt and press return.

4) Then type “reset-all” to restart the computer.

Force Removing Password Protection

1) Add or remove DIMMs to change the total amount of RAM in the computer.

2) Then, the PRAM must be reset 3 times. (Command + Option + P + R).