Enable Telnet and FTP via USB flashdrive

From AwkwardTV
Jump to: navigation, search

NOTE: Because the current mach kernel disables USB at boot, it is currently not possible to progress beyond the boot graphic when using USB. This is a work in progress until there is a new kernel or revised kernel cache file.


These instructions will guide you through the preparation of a USB flash disk that will enable both Telnet and FTP on the Apple TV without opening the case. This method is similar to the method proposed to Enable SSH Without Opening the Apple TV.

Why Telnet and FTP

SSH requires that the sshd binary be owned by root:wheel in order for it to execute. Because of the way that Mac OS X mounts disk images and squashes the UID and GID of the disk image file system, it is complex to ensure that the sshd binary has the proper ownership.

Since the property files and the ftpd binary are already on the Apple TV we only have to add telnetd to our image and modify two lines in each property file.

Once the Apple TV is up with telnet and ftp, you can add any other services that you wish.


  • 512 MB or larger USB flash drive or external USB disk drive
  • a computer that can mount and edit HFS+ dmg images
  • efi.img, recovery.img from an Apple TV drive. (These images are explained and can be created using the steps found in Prepare a Hard Drive.)


This process has several parts:

  • convert the recovery partition image recovery.img to read/write and mount
 hdiutil convert -format UDRW -o recover-rw.dmg recover.img
 hdiutil mount recovery-rw.img
  • convert the OS.dmg file to a read/write image named RW.dmg
 hdiutil convert -format UDRW -o RW.dmg /Volumes/Recovery/OS.dmg
  • mount the new read/write image and obey the file ownership (possible to chown files)
 hdiutil mount -owners on RW.dmg
  • modify the property lists and remove lines 5 and 6 that Disable the services
  cd /Volumes/OSBoot/System/Library/LaunchDaemons/
  cat telnet.plist | sed "5,6d" > telnet.plist
  cat ftp.plist | sed "5,6d" > ftp.plist
  • add an intel binary telnetd to the modified image
 cp telnetd /Volumes/OSBoot/usr/libexec/telnetd
 sudo chown root:wheel /Volumes/OSBoot/usr/libexec/telnetd
  • unmount the read/write image
 hdiutil unmount /Volumes/OSBoot/
  • replace OS.dmg on recovery.imgwith a read-only version of the modified image
 rm /Volumes/Recovery/OS.dmg
 hdiutil convert -format UDZO -o /Volumes/Recovery/OS.dmg RW.dmg
  • unmount the recovery image
 diskutil unmount diskX
  • prepare the partition table on the USB flash disk
 diskutil partitionDisk diskY 1 GPTFormat HFS+ UntitledHFS+ 400M
 diskutil unmount diskY
 gpt remove -i 1 /dev/diskY
 gpt add -b 40 -i 1 -s 69632 -t efi diskY
 gpt add -b 69672 -i 2 -s 819200 -t 5265636F-7665-11AA-AA11-00306543ECAC /dev/diskY
  • copy the partition.img and recovery.img to the USB flash disk
 dd if=efi.img of=/dev/diskYs1
 dd if=/dev/diskX of=/dev/diskYs2
  • plug in the USB flash drive to the Apple TV after its booted
  • press menu and - (minus) on the remote to reboot into restore mode
  • watch to ensure that the USB flash drive is accessed
  • perform the factory restore when prompted