I'm trying to setup an 1st gen AppleTV as an announcements presenter where the screensaver shows graphics that have been uploaded to it via a XAMPP Apache/PHP file manager. The problem is that when the files are updated/removed/changed the screensaver goes black for old images that have been removed and won't show new images until the screensaver is restarted (to be expected.) I need the XBMC screensaver restarted and the only way I know how to do that remotely is to login via SSH and issue a "shutdown -r now" command. I don't want to be doing that at all and I want to be able to remotely control the AppleTV from just the web interface so that I can mount the AppleTV out of the reach of everybody but still control it.

I also need to completely secure it by changing the "frontrow" account password.

I'm at a standstill for completing what I'm trying to do because there are 2 very important commands that are completely missing from the AppleTV, "su" and "passwd".

I need "su", not "sudo". I know you'll suggest sudo, but it absolutely will not work for what I'm trying to do with the web interface scripts, trust me, I already tried it, even the old suggestions of "echo 'password' | sudo -S [some-command". "sudo" is really only for terminal interaction and I can't use it to login to another account from a shell script that is started with an account that doesn't have a password or is allowed to use "sudo" (the "nobody" account used for Apache server). I need a working version of "su" on my AppleTV plain-and-simple. No substitutes. I've tried using versions of "su" from intel macs and non-intel macs but the AppleTV complains about all of them not working for the current processor.

I also need "passwd" so I can change the default password on the "frontrow" account to secure it, but again, all the ones I tried from different Macs cause complaints about the architecture.

Is there version of those binaries that I can download from somewhere that are known to work on 1st gen Apple TVs?

First of all, su really really shouldn't be installed, and yes, you should use sudo (hear me out). In /etc/sudoers, you can give permission to the nobody user to execute a particular command or set of commands, and not require a password to do so. Alternatively, if the command is an executable (not a shell script), you can make the executable suid to root, but this is dangerous.

As far as the changing the password, as I recall this is dangerous in terms of breaking the auto-login which brings up the UI. I would imagine that you really are concerned with restricting ssh so someone can't login as frontrow/frontrow through it. There, you can set ssh to require public key authentication, then someone cannot get in via ssh without the private key. That would not require changing the password.

As far as getting the binaries, if you still want to go that route, you'd be best off with the binaries found on the darwinx86-801.iso. Try searching for it; it's sometimes been hard to find.

You're telling me to use sudo but at least you're giving me something that looks like it would work.

I would prefer to grab the commands though if possible so that I don't inadvertently open a security hole on the webserver. Don't get me wrong though, what you've suggested is probably extremely useful and I am going to test it soon.

Thanks.

And yes, the Darwin ISO gave the commands that worked. However, when I changed the password on frontrow I couldn't login on SSH terminal with the new password (or the old one.) Any ideas why?

Maybe that was another issue with changing the password. I remember there being a few reasons why you shouldn't change the password. Unfortunately, the ATV is a bastardized version of OS X that's missing quite a bit of key functionality. I know that the whole user database is quite crippled. Apple's concern was to have it work with auto-login and didn't care beyond that point. You may find this page of use: Passwd - AwkwardTV

You can reset the password back to the default using the password reset tool: LSOD - AwkwardTV This will only restore the authentication database, it won't blow away any other changes you've made to the device.