Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.sys.mac.system > #71607 > unrolled thread
| Started by | John McWilliams <jpmcw@comcast.net> |
|---|---|
| First post | 2015-03-19 06:52 -0700 |
| Last post | 2015-03-22 13:45 -0700 |
| Articles | 20 on this page of 38 — 11 participants |
Back to article view | Back to comp.sys.mac.system
Migrating to new machine John McWilliams <jpmcw@comcast.net> - 2015-03-19 06:52 -0700
Re: Migrating to new machine nospam@de-ster.demon.nl (J. J. Lodder) - 2015-03-19 16:37 +0100
Re: Migrating to new machine Jolly Roger <jollyroger@pobox.com> - 2015-03-19 16:41 +0000
Re: Migrating to new machine nospam@de-ster.demon.nl (J. J. Lodder) - 2015-03-19 20:09 +0100
Re: Migrating to new machine Aldo Raine <apache@scalpem.net> - 2015-03-19 16:28 -0400
Re: Migrating to new machine me@home.spamsucks.ca (Király) - 2015-03-19 20:45 +0000
Re: Migrating to new machine JF Mezei <jfmezei.spamnot@vaxination.ca> - 2015-03-19 17:32 -0400
Re: Migrating to new machine Jolly Roger <jollyroger@pobox.com> - 2015-03-20 13:07 +0000
Re: Migrating to new machine JF Mezei <jfmezei.spamnot@vaxination.ca> - 2015-03-20 11:53 -0400
Re: Migrating to new machine Jolly Roger <jollyroger@pobox.com> - 2015-03-20 16:27 +0000
Re: Migrating to new machine JF Mezei <jfmezei.spamnot@vaxination.ca> - 2015-03-20 13:23 -0400
Re: Migrating to new machine Lewis <g.kreme@gmail.com.dontsendmecopies> - 2015-03-20 19:23 +0000
Re: Migrating to new machine Paul Sture <nospam@sture.ch> - 2015-03-20 07:56 +0100
Re: Migrating to new machine Lewis <g.kreme@gmail.com.dontsendmecopies> - 2015-03-20 11:20 +0000
Re: Migrating to new machine Jolly Roger <jollyroger@pobox.com> - 2015-03-20 13:14 +0000
Re: Migrating to new machine Lewis <g.kreme@gmail.com.dontsendmecopies> - 2015-03-20 19:25 +0000
Re: Migrating to new machine Jolly Roger <jollyroger@pobox.com> - 2015-03-19 20:39 +0000
Re: Migrating to new machine richard@cogsci.ed.ac.uk (Richard Tobin) - 2015-03-19 21:23 +0000
Re: Migrating to new machine richard@cogsci.ed.ac.uk (Richard Tobin) - 2015-03-19 21:25 +0000
Re: Migrating to new machine nospam@de-ster.demon.nl (J. J. Lodder) - 2015-03-20 09:32 +0100
Re: Migrating to new machine Lewis <g.kreme@gmail.com.dontsendmecopies> - 2015-03-20 11:22 +0000
Re: Migrating to new machine nospam@de-ster.demon.nl (J. J. Lodder) - 2015-03-20 13:10 +0100
Re: Migrating to new machine Jolly Roger <jollyroger@pobox.com> - 2015-03-20 13:21 +0000
Re: Migrating to new machine Lewis <g.kreme@gmail.com.dontsendmecopies> - 2015-03-20 19:19 +0000
Re: Migrating to new machine nospam@de-ster.demon.nl (J. J. Lodder) - 2015-03-21 11:10 +0100
Re: Migrating to new machine Jolly Roger <jollyroger@pobox.com> - 2015-03-21 13:18 +0000
Re: Migrating to new machine nospam@de-ster.demon.nl (J. J. Lodder) - 2015-03-21 14:40 +0100
Re: Migrating to new machine Jolly Roger <jollyroger@pobox.com> - 2015-03-21 13:43 +0000
Re: Migrating to new machine nospam@de-ster.demon.nl (J. J. Lodder) - 2015-03-21 17:33 +0100
Re: Migrating to new machine Jolly Roger <jollyroger@pobox.com> - 2015-03-20 13:18 +0000
Re: Migrating to new machine Warren Oates <warren.oates@gmail.com> - 2015-03-20 10:10 -0400
Re: Migrating to new machine Jolly Roger <jollyroger@pobox.com> - 2015-03-20 14:32 +0000
Re: Migrating to new machine Warren Oates <warren.oates@gmail.com> - 2015-03-20 11:35 -0400
Re: Migrating to new machine nospam <nospam@nospam.invalid> - 2015-03-20 12:30 -0400
Re: Migrating to new machine me@home.spamsucks.ca (Király) - 2015-03-19 16:33 +0000
Re: Migrating to new machine Jolly Roger <jollyroger@pobox.com> - 2015-03-19 16:40 +0000
Re: Migrating to new machine nospam@de-ster.demon.nl (J. J. Lodder) - 2015-03-22 10:46 +0100
Re: Migrating to new machine John McWilliams <jpmcw@comcast.net> - 2015-03-22 13:45 -0700
Page 1 of 2 [1] 2 Next page →
| From | John McWilliams <jpmcw@comcast.net> |
|---|---|
| Date | 2015-03-19 06:52 -0700 |
| Subject | Migrating to new machine |
| Message-ID | <meek9f$bi$1@dont-email.me> |
I've had a Macbook Pro die on me though I was able to make a Time Machine backup, and then migrate that to a working computer (an MBAir) It created another user, the result now being that a number of folders are locked with the red circle meaning don't enter. I can change permissions so that "everybody" can Read and Write, but still no access to the locked folders, such as Documents, Music and so forth. What might be done to access all these folders?
[toc] | [next] | [standalone]
| From | nospam@de-ster.demon.nl (J. J. Lodder) |
|---|---|
| Date | 2015-03-19 16:37 +0100 |
| Message-ID | <1m1ji3s.17m2zzwjyzcj3N@de-ster.xs4all.nl> |
| In reply to | #71607 |
John McWilliams <jpmcw@comcast.net> wrote: > I've had a Macbook Pro die on me though I was able to make a Time > Machine backup, and then migrate that to a working computer (an MBAir) > It created another user, the result now being that a number of folders > are locked with the red circle meaning don't enter. I can change > permissions so that "everybody" can Read and Write, but still no access > to the locked folders, such as Documents, Music and so forth. > > What might be done to access all these folders? Log in as the user who own them, or if you can't, activate the root user, Jan Jan
[toc] | [prev] | [next] | [standalone]
| From | Jolly Roger <jollyroger@pobox.com> |
|---|---|
| Date | 2015-03-19 16:41 +0000 |
| Message-ID | <cn0cinFrucnU5@mid.individual.net> |
| In reply to | #71613 |
On 2015-03-19, J. J. Lodder <nospam@de-ster.demon.nl> wrote: > John McWilliams <jpmcw@comcast.net> wrote: > >> I've had a Macbook Pro die on me though I was able to make a Time >> Machine backup, and then migrate that to a working computer (an MBAir) >> It created another user, the result now being that a number of folders >> are locked with the red circle meaning don't enter. I can change >> permissions so that "everybody" can Read and Write, but still no access >> to the locked folders, such as Documents, Music and so forth. >> >> What might be done to access all these folders? > > Log in as the user who own them, > or if you can't, activate the root user, Note: There's no need to activate the root user when you can simply log into any administrator account and use sudo. -- E-mail sent to this address may be devoured by my ravenous SPAM filter. I often ignore posts from Google. Use a real news client instead. JR
[toc] | [prev] | [next] | [standalone]
| From | nospam@de-ster.demon.nl (J. J. Lodder) |
|---|---|
| Date | 2015-03-19 20:09 +0100 |
| Message-ID | <1m1jrkk.1wx181f13on8hjN@de-ster.xs4all.nl> |
| In reply to | #71618 |
Jolly Roger <jollyroger@pobox.com> wrote: > On 2015-03-19, J. J. Lodder <nospam@de-ster.demon.nl> wrote: > > John McWilliams <jpmcw@comcast.net> wrote: > > > >> I've had a Macbook Pro die on me though I was able to make a Time > >> Machine backup, and then migrate that to a working computer (an MBAir) > >> It created another user, the result now being that a number of folders > >> are locked with the red circle meaning don't enter. I can change > >> permissions so that "everybody" can Read and Write, but still no access > >> to the locked folders, such as Documents, Music and so forth. > >> > >> What might be done to access all these folders? > > > > Log in as the user who own them, > > or if you can't, activate the root user, > > Note: There's no need to activate the root user when you can simply log > into any administrator account and use sudo. The point of activating the root user is that you don't have to sudo, Jan
[toc] | [prev] | [next] | [standalone]
| From | Aldo Raine <apache@scalpem.net> |
|---|---|
| Date | 2015-03-19 16:28 -0400 |
| Message-ID | <mefbhf$fhm$1@news.albasani.net> |
| In reply to | #71626 |
On 3/19/15 3:09 PM, J. J. Lodder wrote: > Jolly Roger <jollyroger@pobox.com> wrote: > >> On 2015-03-19, J. J. Lodder <nospam@de-ster.demon.nl> wrote: >>> John McWilliams <jpmcw@comcast.net> wrote: >>> >>>> I've had a Macbook Pro die on me though I was able to make a Time >>>> Machine backup, and then migrate that to a working computer (an MBAir) >>>> It created another user, the result now being that a number of folders >>>> are locked with the red circle meaning don't enter. I can change >>>> permissions so that "everybody" can Read and Write, but still no access >>>> to the locked folders, such as Documents, Music and so forth. >>>> >>>> What might be done to access all these folders? >>> >>> Log in as the user who own them, >>> or if you can't, activate the root user, >> >> Note: There's no need to activate the root user when you can simply log >> into any administrator account and use sudo. > > The point of activating the root user is that you don't have to sudo, > > Jan > Why wouldn't you want to sudo? -- "My name is Lieutenant Aldo Raine and I'm putting together a special team, and I need me eight soldiers..."
[toc] | [prev] | [next] | [standalone]
| From | me@home.spamsucks.ca (Király) |
|---|---|
| Date | 2015-03-19 20:45 +0000 |
| Message-ID | <mefchl$5te$1@dont-email.me> |
| In reply to | #71630 |
In comp.sys.mac.system Aldo Raine <apache@scalpem.net> wrote: > Why wouldn't you want to sudo? sudo can be far more dangerous than the GUI root user for those inexperienced with the command line. Consider this command to delete a stubborn folder: sudo rm -rf /Users/Shared/stubborn-folder ...and this typo to the above with an additional space: sudo rm -rf /Users /Shared/stubborn-folder Whoops. Whole /Users folder deleted. That mistake is much less likely made, and much more easily undone, when using the GUI root user than than the command line. -- K. Lang may your lum reek.
[toc] | [prev] | [next] | [standalone]
| From | JF Mezei <jfmezei.spamnot@vaxination.ca> |
|---|---|
| Date | 2015-03-19 17:32 -0400 |
| Message-ID | <550b407a$0$1558$c3e8da3$12bcf670@news.astraweb.com> |
| In reply to | #71630 |
On 15-03-19 16:28, Aldo Raine wrote: > Why wouldn't you want to sudo? Sudo doesn't always work in Finder. Some operations are just "can't do that" instead of "please enter admin password". Don't have specifics, but it has happened to me. Sometimes more convenient to use finder to move folders from one place to the next, but when that fails you drop to command line and then use sudo to move it.
[toc] | [prev] | [next] | [standalone]
| From | Jolly Roger <jollyroger@pobox.com> |
|---|---|
| Date | 2015-03-20 13:07 +0000 |
| Message-ID | <cn2kdfFg7j0U2@mid.individual.net> |
| In reply to | #71639 |
On 2015-03-19, JF Mezei <jfmezei.spamnot@vaxination.ca> wrote: > On 15-03-19 16:28, Aldo Raine wrote: > >> Why wouldn't you want to sudo? > > Sudo doesn't always work in Finder. Finder isn't capable of running sudo. Not sure what you are talking about. > Some operations are just "can't do > that" instead of "please enter admin password". Don't have specifics, > but it has happened to me. Without specifics this doesn't mean much either. > Sometimes more convenient to use finder to > move folders from one place to the next, but when that fails you drop to > command line and then use sudo to move it. Not in my experience. Perhaps you just aren't familiar enough with the command line to know how to resolve whatever problem you seem to have encountered. -- E-mail sent to this address may be devoured by my ravenous SPAM filter. I often ignore posts from Google. Use a real news client instead. JR
[toc] | [prev] | [next] | [standalone]
| From | JF Mezei <jfmezei.spamnot@vaxination.ca> |
|---|---|
| Date | 2015-03-20 11:53 -0400 |
| Message-ID | <550c425c$0$39626$c3e8da3$f017e9df@news.astraweb.com> |
| In reply to | #71669 |
On 15-03-20 09:07, Jolly Roger wrote: > Finder isn't capable of running sudo. Not sure what you are talking > about. For some operations, the finder will prompt for your administrator password and do an effective "sudo" on what you are trying to do. But at other times, it does not work. Note that when accessing remote files, a sudo on local machine does nothing because on the remote system, files are accessed by whatever username you specified when you mounted the remote share and the sudo command does not apply to that remote process.
[toc] | [prev] | [next] | [standalone]
| From | Jolly Roger <jollyroger@pobox.com> |
|---|---|
| Date | 2015-03-20 16:27 +0000 |
| Message-ID | <cn302nFikvqU1@mid.individual.net> |
| In reply to | #71678 |
On 2015-03-20, JF Mezei <jfmezei.spamnot@vaxination.ca> wrote: > On 15-03-20 09:07, Jolly Roger wrote: > >> Finder isn't capable of running sudo. Not sure what you are talking >> about. > > For some operations, the finder will prompt for your administrator > password and do an effective "sudo" on what you are trying to do. But at > other times, it does not work. It's always worked for me. When doesn't it work? What happens when it "doesn't work"? Does it ask for credentials at all? What types of operations are in play when it doesn't work? > Note that when accessing remote files, a sudo on local machine does > nothing because on the remote system, files are accessed by whatever > username you specified when you mounted the remote share and the sudo > command does not apply to that remote process. I've never found myself needing to do root operations on remote files. -- E-mail sent to this address may be devoured by my ravenous SPAM filter. I often ignore posts from Google. Use a real news client instead. JR
[toc] | [prev] | [next] | [standalone]
| From | JF Mezei <jfmezei.spamnot@vaxination.ca> |
|---|---|
| Date | 2015-03-20 13:23 -0400 |
| Message-ID | <550c5777$0$20183$c3e8da3$1cbc7475@news.astraweb.com> |
| In reply to | #71681 |
On 15-03-20 12:27, Jolly Roger wrote: > I've never found myself needing to do root operations on remote files. I have. Managing my server from my desktop for instance, sometimes it is nice to be able to use Finder to move folders around etc. So I connect to AFP:://xxxxx@10.0.0.20 where xxxxxx is a user I created with privileges similar to root. This way I can play around the server with the finder on my desktop to manage files, delete files outside of my home directory on the server.
[toc] | [prev] | [next] | [standalone]
| From | Lewis <g.kreme@gmail.com.dontsendmecopies> |
|---|---|
| Date | 2015-03-20 19:23 +0000 |
| Message-ID | <slrnmgosvf.nj.g.kreme@kreme.eternal-september.org> |
| In reply to | #71669 |
Okay, so one time? In band camp? Jolly Roger <jollyroger@pobox.com> was all, like: > Not in my experience. Perhaps you just aren't familiar enough with the > command line to know how to resolve whatever problem you seem to have > encountered. In either 10.1 or maybe 10.2 I did have to enable the root account for something or other. Whatever it was, there was no other way that I could find to do it. -- http://2blog.kreme.com Mirrors contain infinity. Infinity contains more things than you think. Everything, for a start. Including hunger. Because there's a million billion images, but only one soul to go around. --Witches Abroad
[toc] | [prev] | [next] | [standalone]
| From | Paul Sture <nospam@sture.ch> |
|---|---|
| Date | 2015-03-20 07:56 +0100 |
| Message-ID | <9usstb-2m4.ln1@news.chingola.ch> |
| In reply to | #71630 |
On 2015-03-19, Aldo Raine <apache@scalpem.net> wrote: > On 3/19/15 3:09 PM, J. J. Lodder wrote: >> Jolly Roger <jollyroger@pobox.com> wrote: >> >>> On 2015-03-19, J. J. Lodder <nospam@de-ster.demon.nl> wrote: >>>> John McWilliams <jpmcw@comcast.net> wrote: >>>> >>>>> I've had a Macbook Pro die on me though I was able to make a Time >>>>> Machine backup, and then migrate that to a working computer (an MBAir) >>>>> It created another user, the result now being that a number of folders >>>>> are locked with the red circle meaning don't enter. I can change >>>>> permissions so that "everybody" can Read and Write, but still no access >>>>> to the locked folders, such as Documents, Music and so forth. >>>>> >>>>> What might be done to access all these folders? >>>> >>>> Log in as the user who own them, >>>> or if you can't, activate the root user, >>> >>> Note: There's no need to activate the root user when you can simply log >>> into any administrator account and use sudo. >> >> The point of activating the root user is that you don't have to sudo, >> > > Why wouldn't you want to sudo? When you want to string a load of commands together, although that's not the case here. A simple example I recently encountered on Linux: sudo rsync ... # backup entire system I changed that to: sudo time rsync ... # I want to see how long it takes here the sudo applies to the time command not the rsync, so the rsync throws errors when it tries to access files which need root access. For this example, it's simply a matter of putting the 'time' command first. time sudo rsync ... Other cases don't have such an easy workaround. -- Real Daleks don't climb the stairs - real Daleks level the building.
[toc] | [prev] | [next] | [standalone]
| From | Lewis <g.kreme@gmail.com.dontsendmecopies> |
|---|---|
| Date | 2015-03-20 11:20 +0000 |
| Message-ID | <slrnmgo0km.r45.g.kreme@kreme.eternal-september.org> |
| In reply to | #71661 |
Okay, so one time? In band camp? Paul Sture <nospam@sture.ch> was all, like: > Other cases don't have such an easy workaround. If you read man sudo or some stackexchange pages on sudo, you will find that you are wrong. -- http://2blog.kreme.com ...but the senator, while insisting he was not intoxicated, could not explain his nudity.
[toc] | [prev] | [next] | [standalone]
| From | Jolly Roger <jollyroger@pobox.com> |
|---|---|
| Date | 2015-03-20 13:14 +0000 |
| Message-ID | <cn2kq8Fg7j0U3@mid.individual.net> |
| In reply to | #71661 |
On 2015-03-20, Paul Sture <nospam@sture.ch> wrote: > On 2015-03-19, Aldo Raine <apache@scalpem.net> wrote: > >> Why wouldn't you want to sudo? > > When you want to string a load of commands together, although that's > not the case here. > > A simple example I recently encountered on Linux: > > sudo rsync ... # backup entire system > > I changed that to: > > sudo time rsync ... # I want to see how long it takes > > here the sudo applies to the time command not the rsync, so the rsync > throws errors when it tries to access files which need root access. > > For this example, it's simply a matter of putting the 'time' command > first. > > time sudo rsync ... > > Other cases don't have such an easy workaround. Why not just run the commands in a shell?: sudo sh -c 'time whoami' Works fine for me. -- E-mail sent to this address may be devoured by my ravenous SPAM filter. I often ignore posts from Google. Use a real news client instead. JR
[toc] | [prev] | [next] | [standalone]
| From | Lewis <g.kreme@gmail.com.dontsendmecopies> |
|---|---|
| Date | 2015-03-20 19:25 +0000 |
| Message-ID | <slrnmgot22.nj.g.kreme@kreme.eternal-september.org> |
| In reply to | #71670 |
Okay, so one time? In band camp? Jolly Roger <jollyroger@pobox.com> was all, like: > On 2015-03-20, Paul Sture <nospam@sture.ch> wrote: >> On 2015-03-19, Aldo Raine <apache@scalpem.net> wrote: >> >>> Why wouldn't you want to sudo? >> >> When you want to string a load of commands together, although that's >> not the case here. >> >> A simple example I recently encountered on Linux: >> >> sudo rsync ... # backup entire system >> >> I changed that to: >> >> sudo time rsync ... # I want to see how long it takes >> >> here the sudo applies to the time command not the rsync, so the rsync >> throws errors when it tries to access files which need root access. >> >> For this example, it's simply a matter of putting the 'time' command >> first. >> >> time sudo rsync ... >> >> Other cases don't have such an easy workaround. > Why not just run the commands in a shell?: > sudo sh -c 'time whoami' > Works fine for me. Or sudo -s -- "time whoami" -- http://2blog.kreme.com 'What is this thing, anyway?' said the Dean, inspecting the implement in his hands. 'It's called a shovel', said the Senior Wrangler. 'I've seen the gardeners use them. You stick the sharp end in the ground. Then it gets a bit technical.' --Reaper Man
[toc] | [prev] | [next] | [standalone]
| From | Jolly Roger <jollyroger@pobox.com> |
|---|---|
| Date | 2015-03-19 20:39 +0000 |
| Message-ID | <cn0qgoF1vs8U1@mid.individual.net> |
| In reply to | #71626 |
On 2015-03-19, J. J. Lodder <nospam@de-ster.demon.nl> wrote: > Jolly Roger <jollyroger@pobox.com> wrote: > >> On 2015-03-19, J. J. Lodder <nospam@de-ster.demon.nl> wrote: >> > John McWilliams <jpmcw@comcast.net> wrote: >> > >> >> I've had a Macbook Pro die on me though I was able to make a Time >> >> Machine backup, and then migrate that to a working computer (an MBAir) >> >> It created another user, the result now being that a number of folders >> >> are locked with the red circle meaning don't enter. I can change >> >> permissions so that "everybody" can Read and Write, but still no access >> >> to the locked folders, such as Documents, Music and so forth. >> >> >> >> What might be done to access all these folders? >> > >> > Log in as the user who own them, >> > or if you can't, activate the root user, >> >> Note: There's no need to activate the root user when you can simply log >> into any administrator account and use sudo. > > The point of activating the root user is that you don't have to sudo, It's a much better idea to use sudo, mostly do to the widely-accepted principle of least privilege, but also for other good reasons. Least Privilege It's always a good idea to run with as few escalated privileges as possible, because (a) it reduces the *chance* of privilege escalation accidents, and (b) it reduces the *impact* of privilege escalation accidents that do occur. If you need to hear this from a more credible source than some dude on the internet, here's what Apple themselves have to say about it (from page 61 of the Mac OS X Security Configuration Guide @ http://tinyurl.com/augt3w): "Unless you need administrator access for specific system maintenance tasks that cannot be accomplished by authenticating with the administrator's account while logged in as a normal user, always log in as a non-administrator user. Log out of the administrator account when you are not using the computer as an administrator. Never browse the web or check email while logged in to an administrator's account." When you are logged in as administrator or root, everything you do and every program you run (directly or indirectly, purposefully or inadvertently) is executed with administrative or root privileges - meaning it automatically has access to more parts of the system than standard user accounts. This means if you make a mistake while changing, moving, or deleting system files, or running programs, or worse, if you unknowingly run a trojan / worm in your administrative account, you can damage and alter critical system files with little or no protection or acknowledgment from the system. While you certainly could use an administrative account daily without adverse effects, even for months or years without incident, it's the one time it matters that you may want to be concerned about. For instance, I can't tell you how many times I've seen Mac users ask for help because they accidentally deleted some file on their system they might not have deleted so easily had they not been using escalate privileges at the time. While the majority of the files in you home folder are owned by you, lots of files and folders in Mac OS X are owned by the "admin" group, of which every administrative account is a member. When you are logged in as a normal user, Mac OS X will not allow you to modify such parts of the system without first entering the user name and password of an administrative account. This is an additional layer of security you won't have if you are running as administrator. In contrast, when you are logged in as administrator, Mac OS X allows you to change, move, and delete such files and folders without question. And when you are logged in as root, you are given even more power since the system allows you to change *all* files on the entire system without question. I think the reason Apple doesn't give this advise to all Mac users is probably because the long explanation needed to convey the reasons for it and how to do it would probably not be very well received. Most users don't know enough about security issues to understand, and frankly, most just don't want to be bothered. Apple probably could automate the creation of an initial administrative account and a non-administrative account, but if users aren't properly educated about the issues involved, there's no guarantee they would actually use them properly. It's more involved than just offering a one-liner of advice in a user's guide. ; ) There are other good reasons to use sudo rather than logging in as root: Multiple user security Since sudo authentication uses the user password rather than the root password, multiple users may use sudo without sharing the root password. Thoughtfulness Each sudo command requires authentication, which causes you to stop and think about what you are doing. In contrast, when you are logged in as root, commands require no authentication at all, which means it's easier for mistakes to happen. Ticketing When you first invoke sudo and authenticate with your credentials, you are granted a ticket certain number of minutes (usually a default of 5 minutes). Subsequent commands update the timer for another 5 minutes. When no commands have been issues and this 5-minute timer expires, and subsequent commands require you to re-authenticate. This means if you happen to walk away from your computer forgetting you have a sudo session open in a terminal window, someone else won't be able to use your authentication to do things with sudo. Logging Every command you enter when you use sudo is logged in the system log, which enabled the administrator (you) to see who issued which commands on your system. This is preferable from a security point of view, but is also extremely useful for troubleshooting. Script kiddies Automated scripts utilized by many pieces of malware assume that there is an enabled root account and attempt to use brute force to guess the password of that account to gain root access to any machine on the internet. With the Mac OS X root account disabled (as it is in any default installation) prevents this entirely, because it effectively removes that attack vector. I'm sure there are other reasons that haven't occurred to me at the moment; but suffice it to say for all of the above reasons there just isn't much of a good reason to enable the root account in Mac OS X when sudo works well and is very little hassle to use. More information about the least privilege principle is here: <https://en.wikipedia.org/wiki/Principle_of_least_privilege> -- E-mail sent to this address may be devoured by my ravenous SPAM filter. I often ignore posts from Google. Use a real news client instead. JR
[toc] | [prev] | [next] | [standalone]
| From | richard@cogsci.ed.ac.uk (Richard Tobin) |
|---|---|
| Date | 2015-03-19 21:23 +0000 |
| Message-ID | <mefepe$2mf9$1@macpro.inf.ed.ac.uk> |
| In reply to | #71631 |
In article <cn0qgoF1vs8U1@mid.individual.net>, Jolly Roger <jollyroger@pobox.com> wrote: [Reasons for using sudo.] I generally do "sudo bash". Of course this defeats some of the claimed advantages of sudo, but it has the great advantage that normal unix redirection and piping work properly. For example, "sudo cat ... >/etc/whatever" doesn't work because the redirection is done as you, not root. -- Richard
[toc] | [prev] | [next] | [standalone]
| From | richard@cogsci.ed.ac.uk (Richard Tobin) |
|---|---|
| Date | 2015-03-19 21:25 +0000 |
| Message-ID | <mefet4$2mf9$2@macpro.inf.ed.ac.uk> |
| In reply to | #71637 |
In article <mefepe$2mf9$1@macpro.inf.ed.ac.uk>, I wrote: >For example, "sudo cat ... >/etc/whatever" doesn't work because >the redirection is done as you, not root. I forget to mention the even more annoying fact that file name completion doesn't work for directories that you can't read. -- Richard
[toc] | [prev] | [next] | [standalone]
| From | nospam@de-ster.demon.nl (J. J. Lodder) |
|---|---|
| Date | 2015-03-20 09:32 +0100 |
| Message-ID | <1m1ksy3.l29bbjgvyasjN@de-ster.xs4all.nl> |
| In reply to | #71631 |
Jolly Roger <jollyroger@pobox.com> wrote: > On 2015-03-19, J. J. Lodder <nospam@de-ster.demon.nl> wrote: > > Jolly Roger <jollyroger@pobox.com> wrote: > > > >> On 2015-03-19, J. J. Lodder <nospam@de-ster.demon.nl> wrote: > >> > John McWilliams <jpmcw@comcast.net> wrote: > >> > > >> >> I've had a Macbook Pro die on me though I was able to make a Time > >> >> Machine backup, and then migrate that to a working computer (an MBAir) > >> >> It created another user, the result now being that a number of folders > >> >> are locked with the red circle meaning don't enter. I can change > >> >> permissions so that "everybody" can Read and Write, but still no access > >> >> to the locked folders, such as Documents, Music and so forth. > >> >> > >> >> What might be done to access all these folders? > >> > > >> > Log in as the user who own them, > >> > or if you can't, activate the root user, > >> > >> Note: There's no need to activate the root user when you can simply log > >> into any administrator account and use sudo. > > > > The point of activating the root user is that you don't have to sudo, > > It's a much better idea to use sudo, mostly do to the widely-accepted > principle of least privilege, but also for other good reasons. [lots of good reasons] but the good reasons do not apply for a one of a kind job on your own machine where you are all of the users, just to set some obvious problems right, Jan
[toc] | [prev] | [next] | [standalone]
Page 1 of 2 [1] 2 Next page →
Back to top | Article view | comp.sys.mac.system
csiph-web