diff --git a/tools/package/bin/onos-user-password b/tools/package/bin/onos-user-password
new file mode 100755
index 0000000..a7c638c
--- /dev/null
+++ b/tools/package/bin/onos-user-password
@@ -0,0 +1,24 @@
+#!/bin/bash
+# -----------------------------------------------------------------------------
+# Adds or removes the specified user and password to secure ONOS GUI and
+# ONOS REST API; also removes the default user/password entry.
+# -----------------------------------------------------------------------------
+
+usage="usage: $(basename $0) user {password|--remove}"
+
+user=$1
+password=$2
+
+[ -z "$user" -o -z "$password" ] && echo "$usage" >&2 && exit 1
+
+cd $(dirname $0)/../apache-karaf-*/etc
+USERS=users.properties
+
+# Remove the user entry first, in case one was already present.
+# Also remove the built-in user to implicitly secure access.
+egrep -v "^($user|onos)[ ]*=" $USERS > $USERS.new && mv $USERS.new $USERS
+
+# Add the user and the password to the user properties file.
+if [ $password != "--remove" ]; then
+    echo "$user = $password,_g_:admingroup" >> $USERS
+fi