firmware-passwrd.sh

#!/bin/bash

# Jamf Pro Script Parameters:
# $4 = Firmware Password

FIRMWARE_PASSWORD="${4}"

# --- Validate parameter ---
if [[ -z "$FIRMWARE_PASSWORD" ]]; then
    echo "ERROR: No firmware password provided. Pass the password as script parameter \$4."
    exit 1
fi

# --- Check if firmware password is already set ---
FW_STATUS=$( /usr/sbin/firmwarepasswd -check )

if [[ "$FW_STATUS" == *"Password Enabled: Yes"* ]]; then
    echo "A firmware password is already set. Exiting without changes."
    exit 0
fi

# --- Set the firmware password ---
echo "No firmware password detected. Setting now..."

# Pipe the password twice (new + confirmation) via printf
printf "%s\n%s\n" "$FIRMWARE_PASSWORD" "$FIRMWARE_PASSWORD" | \
    /usr/sbin/firmwarepasswd -setpasswd

EXIT_CODE=$?

if [[ $EXIT_CODE -eq 0 ]]; then
    echo "SUCCESS: Firmware password has been set."
    exit 0
else
    echo "ERROR: Failed to set firmware password. Exit code: $EXIT_CODE"
    exit 1
fi