Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > comp.sys.mac.system > #71607 > unrolled thread

Migrating to new machine

Started byJohn McWilliams <jpmcw@comcast.net>
First post2015-03-19 06:52 -0700
Last post2015-03-22 13:45 -0700
Articles 20 on this page of 38 — 11 participants

Back to article view | Back to comp.sys.mac.system


Contents

  Migrating to new machine John McWilliams <jpmcw@comcast.net> - 2015-03-19 06:52 -0700
    Re: Migrating to new machine nospam@de-ster.demon.nl (J. J. Lodder) - 2015-03-19 16:37 +0100
      Re: Migrating to new machine Jolly Roger <jollyroger@pobox.com> - 2015-03-19 16:41 +0000
        Re: Migrating to new machine nospam@de-ster.demon.nl (J. J. Lodder) - 2015-03-19 20:09 +0100
          Re: Migrating to new machine Aldo Raine <apache@scalpem.net> - 2015-03-19 16:28 -0400
            Re: Migrating to new machine me@home.spamsucks.ca (Király) - 2015-03-19 20:45 +0000
            Re: Migrating to new machine JF Mezei <jfmezei.spamnot@vaxination.ca> - 2015-03-19 17:32 -0400
              Re: Migrating to new machine Jolly Roger <jollyroger@pobox.com> - 2015-03-20 13:07 +0000
                Re: Migrating to new machine JF Mezei <jfmezei.spamnot@vaxination.ca> - 2015-03-20 11:53 -0400
                  Re: Migrating to new machine Jolly Roger <jollyroger@pobox.com> - 2015-03-20 16:27 +0000
                    Re: Migrating to new machine JF Mezei <jfmezei.spamnot@vaxination.ca> - 2015-03-20 13:23 -0400
                Re: Migrating to new machine Lewis <g.kreme@gmail.com.dontsendmecopies> - 2015-03-20 19:23 +0000
            Re: Migrating to new machine Paul Sture <nospam@sture.ch> - 2015-03-20 07:56 +0100
              Re: Migrating to new machine Lewis <g.kreme@gmail.com.dontsendmecopies> - 2015-03-20 11:20 +0000
              Re: Migrating to new machine Jolly Roger <jollyroger@pobox.com> - 2015-03-20 13:14 +0000
                Re: Migrating to new machine Lewis <g.kreme@gmail.com.dontsendmecopies> - 2015-03-20 19:25 +0000
          Re: Migrating to new machine Jolly Roger <jollyroger@pobox.com> - 2015-03-19 20:39 +0000
            Re: Migrating to new machine richard@cogsci.ed.ac.uk (Richard Tobin) - 2015-03-19 21:23 +0000
              Re: Migrating to new machine richard@cogsci.ed.ac.uk (Richard Tobin) - 2015-03-19 21:25 +0000
            Re: Migrating to new machine nospam@de-ster.demon.nl (J. J. Lodder) - 2015-03-20 09:32 +0100
              Re: Migrating to new machine Lewis <g.kreme@gmail.com.dontsendmecopies> - 2015-03-20 11:22 +0000
                Re: Migrating to new machine nospam@de-ster.demon.nl (J. J. Lodder) - 2015-03-20 13:10 +0100
                  Re: Migrating to new machine Jolly Roger <jollyroger@pobox.com> - 2015-03-20 13:21 +0000
                    Re: Migrating to new machine Lewis <g.kreme@gmail.com.dontsendmecopies> - 2015-03-20 19:19 +0000
                    Re: Migrating to new machine nospam@de-ster.demon.nl (J. J. Lodder) - 2015-03-21 11:10 +0100
                      Re: Migrating to new machine Jolly Roger <jollyroger@pobox.com> - 2015-03-21 13:18 +0000
                        Re: Migrating to new machine nospam@de-ster.demon.nl (J. J. Lodder) - 2015-03-21 14:40 +0100
                          Re: Migrating to new machine Jolly Roger <jollyroger@pobox.com> - 2015-03-21 13:43 +0000
                            Re: Migrating to new machine nospam@de-ster.demon.nl (J. J. Lodder) - 2015-03-21 17:33 +0100
              Re: Migrating to new machine Jolly Roger <jollyroger@pobox.com> - 2015-03-20 13:18 +0000
                Re: Migrating to new machine Warren Oates <warren.oates@gmail.com> - 2015-03-20 10:10 -0400
                  Re: Migrating to new machine Jolly Roger <jollyroger@pobox.com> - 2015-03-20 14:32 +0000
                    Re: Migrating to new machine Warren Oates <warren.oates@gmail.com> - 2015-03-20 11:35 -0400
                  Re: Migrating to new machine nospam <nospam@nospam.invalid> - 2015-03-20 12:30 -0400
    Re: Migrating to new machine me@home.spamsucks.ca (Király) - 2015-03-19 16:33 +0000
      Re: Migrating to new machine Jolly Roger <jollyroger@pobox.com> - 2015-03-19 16:40 +0000
    Re: Migrating to new machine nospam@de-ster.demon.nl (J. J. Lodder) - 2015-03-22 10:46 +0100
      Re: Migrating to new machine John McWilliams <jpmcw@comcast.net> - 2015-03-22 13:45 -0700

Page 1 of 2  [1] 2  Next page →


#71607 — Migrating to new machine

FromJohn McWilliams <jpmcw@comcast.net>
Date2015-03-19 06:52 -0700
SubjectMigrating to new machine
Message-ID<meek9f$bi$1@dont-email.me>
I've had a Macbook Pro die on me though I was able to make a Time 
Machine backup, and then migrate that to a working computer (an MBAir) 
It created another user, the result now being that a number of folders 
are locked with the red circle meaning don't enter. I can change 
permissions so that "everybody" can Read and Write, but still no access 
to the locked folders, such as Documents, Music and so forth.

What might be done to access all these folders?

[toc] | [next] | [standalone]


#71613

Fromnospam@de-ster.demon.nl (J. J. Lodder)
Date2015-03-19 16:37 +0100
Message-ID<1m1ji3s.17m2zzwjyzcj3N@de-ster.xs4all.nl>
In reply to#71607
John McWilliams <jpmcw@comcast.net> wrote:

> I've had a Macbook Pro die on me though I was able to make a Time 
> Machine backup, and then migrate that to a working computer (an MBAir)
> It created another user, the result now being that a number of folders
> are locked with the red circle meaning don't enter. I can change 
> permissions so that "everybody" can Read and Write, but still no access
> to the locked folders, such as Documents, Music and so forth.
> 
> What might be done to access all these folders?

Log in as the user who own them,
or if you can't, activate the root user,

Jan


Jan

[toc] | [prev] | [next] | [standalone]


#71618

FromJolly Roger <jollyroger@pobox.com>
Date2015-03-19 16:41 +0000
Message-ID<cn0cinFrucnU5@mid.individual.net>
In reply to#71613
On 2015-03-19, J. J. Lodder <nospam@de-ster.demon.nl> wrote:
> John McWilliams <jpmcw@comcast.net> wrote:
>
>> I've had a Macbook Pro die on me though I was able to make a Time 
>> Machine backup, and then migrate that to a working computer (an MBAir)
>> It created another user, the result now being that a number of folders
>> are locked with the red circle meaning don't enter. I can change 
>> permissions so that "everybody" can Read and Write, but still no access
>> to the locked folders, such as Documents, Music and so forth.
>> 
>> What might be done to access all these folders?
>
> Log in as the user who own them,
> or if you can't, activate the root user,

Note: There's no need to activate the root user when you can simply log
into any administrator account and use sudo.

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

[toc] | [prev] | [next] | [standalone]


#71626

Fromnospam@de-ster.demon.nl (J. J. Lodder)
Date2015-03-19 20:09 +0100
Message-ID<1m1jrkk.1wx181f13on8hjN@de-ster.xs4all.nl>
In reply to#71618
Jolly Roger <jollyroger@pobox.com> wrote:

> On 2015-03-19, J. J. Lodder <nospam@de-ster.demon.nl> wrote:
> > John McWilliams <jpmcw@comcast.net> wrote:
> >
> >> I've had a Macbook Pro die on me though I was able to make a Time 
> >> Machine backup, and then migrate that to a working computer (an MBAir)
> >> It created another user, the result now being that a number of folders
> >> are locked with the red circle meaning don't enter. I can change 
> >> permissions so that "everybody" can Read and Write, but still no access
> >> to the locked folders, such as Documents, Music and so forth.
> >> 
> >> What might be done to access all these folders?
> >
> > Log in as the user who own them,
> > or if you can't, activate the root user,
> 
> Note: There's no need to activate the root user when you can simply log
> into any administrator account and use sudo.

The point of activating the root user is that you don't have to sudo,

Jan

[toc] | [prev] | [next] | [standalone]


#71630

FromAldo Raine <apache@scalpem.net>
Date2015-03-19 16:28 -0400
Message-ID<mefbhf$fhm$1@news.albasani.net>
In reply to#71626
On 3/19/15 3:09 PM, J. J. Lodder wrote:
> Jolly Roger <jollyroger@pobox.com> wrote:
>
>> On 2015-03-19, J. J. Lodder <nospam@de-ster.demon.nl> wrote:
>>> John McWilliams <jpmcw@comcast.net> wrote:
>>>
>>>> I've had a Macbook Pro die on me though I was able to make a Time
>>>> Machine backup, and then migrate that to a working computer (an MBAir)
>>>> It created another user, the result now being that a number of folders
>>>> are locked with the red circle meaning don't enter. I can change
>>>> permissions so that "everybody" can Read and Write, but still no access
>>>> to the locked folders, such as Documents, Music and so forth.
>>>>
>>>> What might be done to access all these folders?
>>>
>>> Log in as the user who own them,
>>> or if you can't, activate the root user,
>>
>> Note: There's no need to activate the root user when you can simply log
>> into any administrator account and use sudo.
>
> The point of activating the root user is that you don't have to sudo,
>
> Jan
>

Why wouldn't you want to sudo?

-- 
"My name is Lieutenant Aldo Raine and I'm putting together a special 
team, and I need me eight soldiers..."

[toc] | [prev] | [next] | [standalone]


#71633

Fromme@home.spamsucks.ca (Király)
Date2015-03-19 20:45 +0000
Message-ID<mefchl$5te$1@dont-email.me>
In reply to#71630
In comp.sys.mac.system Aldo Raine <apache@scalpem.net> wrote:
> Why wouldn't you want to sudo?

sudo can be far more dangerous than the GUI root user for those
inexperienced with the command line.

Consider this command to delete a stubborn folder:

sudo rm -rf /Users/Shared/stubborn-folder

...and this typo to the above with an additional space:

sudo rm -rf /Users /Shared/stubborn-folder

Whoops. Whole /Users folder deleted. That mistake is much less likely 
made, and much more easily undone, when using the GUI root user than 
than the command line.

-- 
K.

Lang may your lum reek.

[toc] | [prev] | [next] | [standalone]


#71639

FromJF Mezei <jfmezei.spamnot@vaxination.ca>
Date2015-03-19 17:32 -0400
Message-ID<550b407a$0$1558$c3e8da3$12bcf670@news.astraweb.com>
In reply to#71630
On 15-03-19 16:28, Aldo Raine wrote:

> Why wouldn't you want to sudo?


Sudo doesn't always work in Finder. Some operations are just "can't do
that" instead of "please enter admin password".  Don't have specifics,
but it has happened to me. Sometimes more convenient to use finder to
move folders from one place to the next, but when that fails you drop to
command line and then use sudo to move it.

[toc] | [prev] | [next] | [standalone]


#71669

FromJolly Roger <jollyroger@pobox.com>
Date2015-03-20 13:07 +0000
Message-ID<cn2kdfFg7j0U2@mid.individual.net>
In reply to#71639
On 2015-03-19, JF Mezei <jfmezei.spamnot@vaxination.ca> wrote:
> On 15-03-19 16:28, Aldo Raine wrote:
>
>> Why wouldn't you want to sudo?
>
> Sudo doesn't always work in Finder.

Finder isn't capable of running sudo. Not sure what you are talking
about.

> Some operations are just "can't do
> that" instead of "please enter admin password".  Don't have specifics,
> but it has happened to me. 

Without specifics this doesn't mean much either.

> Sometimes more convenient to use finder to
> move folders from one place to the next, but when that fails you drop to
> command line and then use sudo to move it.

Not in my experience. Perhaps you just aren't familiar enough with the
command line to know how to resolve whatever problem you seem to have
encountered.

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

[toc] | [prev] | [next] | [standalone]


#71678

FromJF Mezei <jfmezei.spamnot@vaxination.ca>
Date2015-03-20 11:53 -0400
Message-ID<550c425c$0$39626$c3e8da3$f017e9df@news.astraweb.com>
In reply to#71669
On 15-03-20 09:07, Jolly Roger wrote:

> Finder isn't capable of running sudo. Not sure what you are talking
> about.

For some operations, the finder will prompt for your administrator
password and do an effective "sudo" on what you are trying to do. But at
other times, it does not work.

Note that when accessing remote files, a sudo on local machine does
nothing because on the remote system, files are accessed by whatever
username you specified when you mounted the remote share and the sudo
command does not apply to that remote process.

[toc] | [prev] | [next] | [standalone]


#71681

FromJolly Roger <jollyroger@pobox.com>
Date2015-03-20 16:27 +0000
Message-ID<cn302nFikvqU1@mid.individual.net>
In reply to#71678
On 2015-03-20, JF Mezei <jfmezei.spamnot@vaxination.ca> wrote:
> On 15-03-20 09:07, Jolly Roger wrote:
>
>> Finder isn't capable of running sudo. Not sure what you are talking
>> about.
>
> For some operations, the finder will prompt for your administrator
> password and do an effective "sudo" on what you are trying to do. But at
> other times, it does not work.

It's always worked for me. When doesn't it work? What happens when it
"doesn't work"? Does it ask for credentials at all? What types of
operations are in play when it doesn't work?

> Note that when accessing remote files, a sudo on local machine does
> nothing because on the remote system, files are accessed by whatever
> username you specified when you mounted the remote share and the sudo
> command does not apply to that remote process.

I've never found myself needing to do root operations on remote files.

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

[toc] | [prev] | [next] | [standalone]


#71683

FromJF Mezei <jfmezei.spamnot@vaxination.ca>
Date2015-03-20 13:23 -0400
Message-ID<550c5777$0$20183$c3e8da3$1cbc7475@news.astraweb.com>
In reply to#71681
On 15-03-20 12:27, Jolly Roger wrote:

> I've never found myself needing to do root operations on remote files.


I have. Managing my server from my desktop for instance, sometimes it is
nice to be able to use Finder to move folders around etc. So I connect
to AFP:://xxxxx@10.0.0.20  where xxxxxx is a user I created with
privileges similar to root.  This way I can play around the server with
the finder on my desktop to manage files, delete files outside of my
home directory on the server.

[toc] | [prev] | [next] | [standalone]


#71687

FromLewis <g.kreme@gmail.com.dontsendmecopies>
Date2015-03-20 19:23 +0000
Message-ID<slrnmgosvf.nj.g.kreme@kreme.eternal-september.org>
In reply to#71669
Okay, so one time? In band camp? Jolly Roger <jollyroger@pobox.com> was all, like:
> Not in my experience. Perhaps you just aren't familiar enough with the
> command line to know how to resolve whatever problem you seem to have
> encountered.

In either 10.1 or maybe 10.2 I did have to enable the root account for
something or other. Whatever it was, there was no other way that I could
find to do it.

-- 
http://2blog.kreme.com
Mirrors contain infinity. Infinity contains more things than you think.
Everything, for a start. Including hunger. Because there's a million
billion images, but only one soul to go around. --Witches Abroad

[toc] | [prev] | [next] | [standalone]


#71661

FromPaul Sture <nospam@sture.ch>
Date2015-03-20 07:56 +0100
Message-ID<9usstb-2m4.ln1@news.chingola.ch>
In reply to#71630
On 2015-03-19, Aldo Raine <apache@scalpem.net> wrote:
> On 3/19/15 3:09 PM, J. J. Lodder wrote:
>> Jolly Roger <jollyroger@pobox.com> wrote:
>>
>>> On 2015-03-19, J. J. Lodder <nospam@de-ster.demon.nl> wrote:
>>>> John McWilliams <jpmcw@comcast.net> wrote:
>>>>
>>>>> I've had a Macbook Pro die on me though I was able to make a Time
>>>>> Machine backup, and then migrate that to a working computer (an MBAir)
>>>>> It created another user, the result now being that a number of folders
>>>>> are locked with the red circle meaning don't enter. I can change
>>>>> permissions so that "everybody" can Read and Write, but still no access
>>>>> to the locked folders, such as Documents, Music and so forth.
>>>>>
>>>>> What might be done to access all these folders?
>>>>
>>>> Log in as the user who own them,
>>>> or if you can't, activate the root user,
>>>
>>> Note: There's no need to activate the root user when you can simply log
>>> into any administrator account and use sudo.
>>
>> The point of activating the root user is that you don't have to sudo,
>>
>
> Why wouldn't you want to sudo?

When you want to string a load of commands together, although that's
not the case here.

A simple example I recently encountered on Linux:

sudo rsync ... # backup entire system

I changed that to:

sudo time rsync ... # I want to see how long it takes

here the sudo applies to the time command not the rsync, so the rsync
throws errors when it tries to access files which need root access.

For this example, it's simply a matter of putting the 'time' command
first.

time sudo rsync ...

Other cases don't have such an easy workaround.

-- 
Real Daleks don't climb the stairs - real Daleks level the building.

[toc] | [prev] | [next] | [standalone]


#71663

FromLewis <g.kreme@gmail.com.dontsendmecopies>
Date2015-03-20 11:20 +0000
Message-ID<slrnmgo0km.r45.g.kreme@kreme.eternal-september.org>
In reply to#71661
Okay, so one time? In band camp? Paul Sture <nospam@sture.ch> was all, like:

> Other cases don't have such an easy workaround.

If you read man sudo or some stackexchange pages on sudo, you will find
that you are wrong.

-- 
http://2blog.kreme.com
...but the senator, while insisting he was not intoxicated, could not
explain his nudity.

[toc] | [prev] | [next] | [standalone]


#71670

FromJolly Roger <jollyroger@pobox.com>
Date2015-03-20 13:14 +0000
Message-ID<cn2kq8Fg7j0U3@mid.individual.net>
In reply to#71661
On 2015-03-20, Paul Sture <nospam@sture.ch> wrote:
> On 2015-03-19, Aldo Raine <apache@scalpem.net> wrote:
>
>> Why wouldn't you want to sudo?
>
> When you want to string a load of commands together, although that's
> not the case here.
>
> A simple example I recently encountered on Linux:
>
> sudo rsync ... # backup entire system
>
> I changed that to:
>
> sudo time rsync ... # I want to see how long it takes
>
> here the sudo applies to the time command not the rsync, so the rsync
> throws errors when it tries to access files which need root access.
>
> For this example, it's simply a matter of putting the 'time' command
> first.
>
> time sudo rsync ...
>
> Other cases don't have such an easy workaround.

Why not just run the commands in a shell?:

sudo sh -c 'time whoami'

Works fine for me.

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

[toc] | [prev] | [next] | [standalone]


#71688

FromLewis <g.kreme@gmail.com.dontsendmecopies>
Date2015-03-20 19:25 +0000
Message-ID<slrnmgot22.nj.g.kreme@kreme.eternal-september.org>
In reply to#71670
Okay, so one time? In band camp? Jolly Roger <jollyroger@pobox.com> was all, like:
> On 2015-03-20, Paul Sture <nospam@sture.ch> wrote:
>> On 2015-03-19, Aldo Raine <apache@scalpem.net> wrote:
>>
>>> Why wouldn't you want to sudo?
>>
>> When you want to string a load of commands together, although that's
>> not the case here.
>>
>> A simple example I recently encountered on Linux:
>>
>> sudo rsync ... # backup entire system
>>
>> I changed that to:
>>
>> sudo time rsync ... # I want to see how long it takes
>>
>> here the sudo applies to the time command not the rsync, so the rsync
>> throws errors when it tries to access files which need root access.
>>
>> For this example, it's simply a matter of putting the 'time' command
>> first.
>>
>> time sudo rsync ...
>>
>> Other cases don't have such an easy workaround.

> Why not just run the commands in a shell?:

> sudo sh -c 'time whoami'

> Works fine for me.

Or sudo -s -- "time whoami"


-- 
http://2blog.kreme.com
'What is this thing, anyway?' said the Dean, inspecting the implement in
his hands. 'It's called a shovel', said the Senior Wrangler. 'I've seen
the gardeners use them. You stick the sharp end in the ground. Then it
gets a bit technical.' --Reaper Man

[toc] | [prev] | [next] | [standalone]


#71631

FromJolly Roger <jollyroger@pobox.com>
Date2015-03-19 20:39 +0000
Message-ID<cn0qgoF1vs8U1@mid.individual.net>
In reply to#71626
On 2015-03-19, J. J. Lodder <nospam@de-ster.demon.nl> wrote:
> Jolly Roger <jollyroger@pobox.com> wrote:
>
>> On 2015-03-19, J. J. Lodder <nospam@de-ster.demon.nl> wrote:
>> > John McWilliams <jpmcw@comcast.net> wrote:
>> >
>> >> I've had a Macbook Pro die on me though I was able to make a Time 
>> >> Machine backup, and then migrate that to a working computer (an MBAir)
>> >> It created another user, the result now being that a number of folders
>> >> are locked with the red circle meaning don't enter. I can change 
>> >> permissions so that "everybody" can Read and Write, but still no access
>> >> to the locked folders, such as Documents, Music and so forth.
>> >> 
>> >> What might be done to access all these folders?
>> >
>> > Log in as the user who own them,
>> > or if you can't, activate the root user,
>> 
>> Note: There's no need to activate the root user when you can simply log
>> into any administrator account and use sudo.
>
> The point of activating the root user is that you don't have to sudo,

It's a much better idea to use sudo, mostly do to the widely-accepted
principle of least privilege, but also for other good reasons. 

Least Privilege

It's always a good idea to run with as few escalated privileges as
possible, because (a) it reduces the *chance* of privilege escalation
accidents, and (b) it reduces the *impact* of privilege escalation
accidents that do occur. If you need to hear this from a more credible
source than some dude on the internet, here's what Apple themselves have
to say about it (from page 61 of the Mac OS X Security Configuration
Guide @ http://tinyurl.com/augt3w):

"Unless you need administrator access for specific system maintenance
tasks that cannot be accomplished by authenticating with the
administrator's account while logged in as a normal user, always log in
as a non-administrator user.  Log out of the administrator account when
you are not using the computer as an administrator. Never browse the web
or check email while logged in to an administrator's account."

When you are logged in as administrator or root, everything you do and
every program you run (directly or indirectly, purposefully or
inadvertently) is executed with administrative or root privileges -
meaning it automatically has access to more parts of the system than
standard user accounts. This means if you make a mistake while changing,
moving, or deleting system files, or running programs, or worse, if you
unknowingly run a trojan / worm in your administrative account, you can
damage and alter critical system files with little or no protection or
acknowledgment from the system. 

While you certainly could use an administrative account daily without
adverse effects, even for months or years without incident, it's the one
time it matters that you may want to be concerned about. For instance, I
can't tell you how many times I've seen Mac users ask for help because
they accidentally deleted some file on their system they might not have
deleted so easily had they not been using escalate privileges at the
time.

While the majority of the files in you home folder are owned by you,
lots of files and folders in Mac OS X are owned by the "admin" group, of
which every administrative account is a member. When you are logged in
as a normal user, Mac OS X will not allow you to modify such parts of
the system without first entering the user name and password of an
administrative account. This is an additional layer of security you
won't have if you are running as administrator. In contrast, when you
are logged in as administrator, Mac OS X allows you to change, move, and
delete such files and folders without question. And when you are logged
in as root, you are given even more power since the system allows you to
change *all* files on the entire system without question.

I think the reason Apple doesn't give this advise to all Mac users is
probably because the long explanation needed to convey the reasons for
it and how to do it would probably not be very well received. Most users
don't know enough about security issues to understand, and frankly, most
just don't want to be bothered. Apple probably could automate the
creation of an initial administrative account and a non-administrative
account, but if users aren't properly educated about the issues
involved, there's no guarantee they would actually use them properly.
It's more involved than just offering a one-liner of advice in a user's
guide. ; )

There are other good reasons to use sudo rather than logging in as root:

Multiple user security

Since sudo authentication uses the user password rather than the root
password, multiple users may use sudo without sharing the root password.

Thoughtfulness

Each sudo command requires authentication, which causes you to stop and
think about what you are doing. In contrast, when you are logged in as
root, commands require no authentication at all, which means it's easier
for mistakes to happen.

Ticketing

When you first invoke sudo and authenticate with your credentials, you
are granted a ticket certain number of minutes (usually a default of 5
minutes). Subsequent commands update the timer for another 5 minutes.
When no commands have been issues and this 5-minute timer expires, and
subsequent commands require you to re-authenticate. This means if you
happen to walk away from your computer forgetting you have a sudo
session open in a terminal window, someone else won't be able to use
your authentication to do things with sudo.

Logging

Every command you enter when you use sudo is logged in the system log,
which enabled the administrator (you) to see who issued which commands
on your system. This is preferable from a security point of view, but is
also extremely useful for troubleshooting.

Script kiddies

Automated scripts utilized by many pieces of malware assume that there
is an enabled root account and attempt to use brute force to guess the
password of that account to gain root access to any machine on the
internet. With the Mac OS X root account disabled (as it is in any
default installation) prevents this entirely, because it effectively
removes that attack vector.

I'm sure there are other reasons that haven't occurred to me at the
moment; but suffice it to say for all of the above reasons there just
isn't much of a good reason to enable the root account in Mac OS X when
sudo works well and is very little hassle to use.

More information about the least privilege principle is here:
<https://en.wikipedia.org/wiki/Principle_of_least_privilege>

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

[toc] | [prev] | [next] | [standalone]


#71637

Fromrichard@cogsci.ed.ac.uk (Richard Tobin)
Date2015-03-19 21:23 +0000
Message-ID<mefepe$2mf9$1@macpro.inf.ed.ac.uk>
In reply to#71631
In article <cn0qgoF1vs8U1@mid.individual.net>,
Jolly Roger  <jollyroger@pobox.com> wrote:
[Reasons for using sudo.]

I generally do "sudo bash".  Of course this defeats some of the
claimed advantages of sudo, but it has the great advantage that normal
unix redirection and piping work properly.

For example, "sudo cat ... >/etc/whatever" doesn't work because
the redirection is done as you, not root.

-- Richard

[toc] | [prev] | [next] | [standalone]


#71638

Fromrichard@cogsci.ed.ac.uk (Richard Tobin)
Date2015-03-19 21:25 +0000
Message-ID<mefet4$2mf9$2@macpro.inf.ed.ac.uk>
In reply to#71637
In article <mefepe$2mf9$1@macpro.inf.ed.ac.uk>, I wrote:

>For example, "sudo cat ... >/etc/whatever" doesn't work because
>the redirection is done as you, not root.

I forget to mention the even more annoying fact that file name
completion doesn't work for directories that you can't read.

-- Richard

[toc] | [prev] | [next] | [standalone]


#71662

Fromnospam@de-ster.demon.nl (J. J. Lodder)
Date2015-03-20 09:32 +0100
Message-ID<1m1ksy3.l29bbjgvyasjN@de-ster.xs4all.nl>
In reply to#71631
Jolly Roger <jollyroger@pobox.com> wrote:

> On 2015-03-19, J. J. Lodder <nospam@de-ster.demon.nl> wrote:
> > Jolly Roger <jollyroger@pobox.com> wrote:
> >
> >> On 2015-03-19, J. J. Lodder <nospam@de-ster.demon.nl> wrote:
> >> > John McWilliams <jpmcw@comcast.net> wrote:
> >> >
> >> >> I've had a Macbook Pro die on me though I was able to make a Time
> >> >> Machine backup, and then migrate that to a working computer (an MBAir)
> >> >> It created another user, the result now being that a number of folders
> >> >> are locked with the red circle meaning don't enter. I can change
> >> >> permissions so that "everybody" can Read and Write, but still no access
> >> >> to the locked folders, such as Documents, Music and so forth.
> >> >> 
> >> >> What might be done to access all these folders?
> >> >
> >> > Log in as the user who own them,
> >> > or if you can't, activate the root user,
> >> 
> >> Note: There's no need to activate the root user when you can simply log
> >> into any administrator account and use sudo.
> >
> > The point of activating the root user is that you don't have to sudo,
> 
> It's a much better idea to use sudo, mostly do to the widely-accepted
> principle of least privilege, but also for other good reasons. 

[lots of good reasons]
but the good reasons do not apply for a one of a kind job
on your own machine where you are all of the users,
just to set some obvious problems right,

Jan

[toc] | [prev] | [next] | [standalone]


Page 1 of 2  [1] 2  Next page →

Back to top | Article view | comp.sys.mac.system


csiph-web