Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.sys.mac.system > #71631

Re: Migrating to new machine

Cross-posted to 2 groups.

Show all headers | View raw

On 2015-03-19, J. J. Lodder <nospam@de-ster.demon.nl> wrote:
> Jolly Roger <jollyroger@pobox.com> wrote:
>
>> On 2015-03-19, J. J. Lodder <nospam@de-ster.demon.nl> wrote:
>> > John McWilliams <jpmcw@comcast.net> wrote:
>> >
>> >> I've had a Macbook Pro die on me though I was able to make a Time 
>> >> Machine backup, and then migrate that to a working computer (an MBAir)
>> >> It created another user, the result now being that a number of folders
>> >> are locked with the red circle meaning don't enter. I can change 
>> >> permissions so that "everybody" can Read and Write, but still no access
>> >> to the locked folders, such as Documents, Music and so forth.
>> >> 
>> >> What might be done to access all these folders?
>> >
>> > Log in as the user who own them,
>> > or if you can't, activate the root user,
>> 
>> Note: There's no need to activate the root user when you can simply log
>> into any administrator account and use sudo.
>
> The point of activating the root user is that you don't have to sudo,

It's a much better idea to use sudo, mostly do to the widely-accepted
principle of least privilege, but also for other good reasons. 

Least Privilege

It's always a good idea to run with as few escalated privileges as
possible, because (a) it reduces the *chance* of privilege escalation
accidents, and (b) it reduces the *impact* of privilege escalation
accidents that do occur. If you need to hear this from a more credible
source than some dude on the internet, here's what Apple themselves have
to say about it (from page 61 of the Mac OS X Security Configuration
Guide @ http://tinyurl.com/augt3w):

"Unless you need administrator access for specific system maintenance
tasks that cannot be accomplished by authenticating with the
administrator's account while logged in as a normal user, always log in
as a non-administrator user.  Log out of the administrator account when
you are not using the computer as an administrator. Never browse the web
or check email while logged in to an administrator's account."

When you are logged in as administrator or root, everything you do and
every program you run (directly or indirectly, purposefully or
inadvertently) is executed with administrative or root privileges -
meaning it automatically has access to more parts of the system than
standard user accounts. This means if you make a mistake while changing,
moving, or deleting system files, or running programs, or worse, if you
unknowingly run a trojan / worm in your administrative account, you can
damage and alter critical system files with little or no protection or
acknowledgment from the system. 

While you certainly could use an administrative account daily without
adverse effects, even for months or years without incident, it's the one
time it matters that you may want to be concerned about. For instance, I
can't tell you how many times I've seen Mac users ask for help because
they accidentally deleted some file on their system they might not have
deleted so easily had they not been using escalate privileges at the
time.

While the majority of the files in you home folder are owned by you,
lots of files and folders in Mac OS X are owned by the "admin" group, of
which every administrative account is a member. When you are logged in
as a normal user, Mac OS X will not allow you to modify such parts of
the system without first entering the user name and password of an
administrative account. This is an additional layer of security you
won't have if you are running as administrator. In contrast, when you
are logged in as administrator, Mac OS X allows you to change, move, and
delete such files and folders without question. And when you are logged
in as root, you are given even more power since the system allows you to
change *all* files on the entire system without question.

I think the reason Apple doesn't give this advise to all Mac users is
probably because the long explanation needed to convey the reasons for
it and how to do it would probably not be very well received. Most users
don't know enough about security issues to understand, and frankly, most
just don't want to be bothered. Apple probably could automate the
creation of an initial administrative account and a non-administrative
account, but if users aren't properly educated about the issues
involved, there's no guarantee they would actually use them properly.
It's more involved than just offering a one-liner of advice in a user's
guide. ; )

There are other good reasons to use sudo rather than logging in as root:

Multiple user security

Since sudo authentication uses the user password rather than the root
password, multiple users may use sudo without sharing the root password.

Thoughtfulness

Each sudo command requires authentication, which causes you to stop and
think about what you are doing. In contrast, when you are logged in as
root, commands require no authentication at all, which means it's easier
for mistakes to happen.

Ticketing

When you first invoke sudo and authenticate with your credentials, you
are granted a ticket certain number of minutes (usually a default of 5
minutes). Subsequent commands update the timer for another 5 minutes.
When no commands have been issues and this 5-minute timer expires, and
subsequent commands require you to re-authenticate. This means if you
happen to walk away from your computer forgetting you have a sudo
session open in a terminal window, someone else won't be able to use
your authentication to do things with sudo.

Logging

Every command you enter when you use sudo is logged in the system log,
which enabled the administrator (you) to see who issued which commands
on your system. This is preferable from a security point of view, but is
also extremely useful for troubleshooting.

Script kiddies

Automated scripts utilized by many pieces of malware assume that there
is an enabled root account and attempt to use brute force to guess the
password of that account to gain root access to any machine on the
internet. With the Mac OS X root account disabled (as it is in any
default installation) prevents this entirely, because it effectively
removes that attack vector.

I'm sure there are other reasons that haven't occurred to me at the
moment; but suffice it to say for all of the above reasons there just
isn't much of a good reason to enable the root account in Mac OS X when
sudo works well and is very little hassle to use.

More information about the least privilege principle is here:
<https://en.wikipedia.org/wiki/Principle_of_least_privilege>

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

Back to comp.sys.mac.system | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Migrating to new machine John McWilliams <jpmcw@comcast.net> - 2015-03-19 06:52 -0700
  Re: Migrating to new machine nospam@de-ster.demon.nl (J. J. Lodder) - 2015-03-19 16:37 +0100
    Re: Migrating to new machine Jolly Roger <jollyroger@pobox.com> - 2015-03-19 16:41 +0000
      Re: Migrating to new machine nospam@de-ster.demon.nl (J. J. Lodder) - 2015-03-19 20:09 +0100
        Re: Migrating to new machine Aldo Raine <apache@scalpem.net> - 2015-03-19 16:28 -0400
          Re: Migrating to new machine me@home.spamsucks.ca (Király) - 2015-03-19 20:45 +0000
          Re: Migrating to new machine JF Mezei <jfmezei.spamnot@vaxination.ca> - 2015-03-19 17:32 -0400
            Re: Migrating to new machine Jolly Roger <jollyroger@pobox.com> - 2015-03-20 13:07 +0000
              Re: Migrating to new machine JF Mezei <jfmezei.spamnot@vaxination.ca> - 2015-03-20 11:53 -0400
                Re: Migrating to new machine Jolly Roger <jollyroger@pobox.com> - 2015-03-20 16:27 +0000
                Re: Migrating to new machine JF Mezei <jfmezei.spamnot@vaxination.ca> - 2015-03-20 13:23 -0400
              Re: Migrating to new machine Lewis <g.kreme@gmail.com.dontsendmecopies> - 2015-03-20 19:23 +0000
          Re: Migrating to new machine Paul Sture <nospam@sture.ch> - 2015-03-20 07:56 +0100
            Re: Migrating to new machine Lewis <g.kreme@gmail.com.dontsendmecopies> - 2015-03-20 11:20 +0000
            Re: Migrating to new machine Jolly Roger <jollyroger@pobox.com> - 2015-03-20 13:14 +0000
              Re: Migrating to new machine Lewis <g.kreme@gmail.com.dontsendmecopies> - 2015-03-20 19:25 +0000
        Re: Migrating to new machine Jolly Roger <jollyroger@pobox.com> - 2015-03-19 20:39 +0000
          Re: Migrating to new machine richard@cogsci.ed.ac.uk (Richard Tobin) - 2015-03-19 21:23 +0000
            Re: Migrating to new machine richard@cogsci.ed.ac.uk (Richard Tobin) - 2015-03-19 21:25 +0000
          Re: Migrating to new machine nospam@de-ster.demon.nl (J. J. Lodder) - 2015-03-20 09:32 +0100
            Re: Migrating to new machine Lewis <g.kreme@gmail.com.dontsendmecopies> - 2015-03-20 11:22 +0000
              Re: Migrating to new machine nospam@de-ster.demon.nl (J. J. Lodder) - 2015-03-20 13:10 +0100
                Re: Migrating to new machine Jolly Roger <jollyroger@pobox.com> - 2015-03-20 13:21 +0000
                Re: Migrating to new machine Lewis <g.kreme@gmail.com.dontsendmecopies> - 2015-03-20 19:19 +0000
                Re: Migrating to new machine nospam@de-ster.demon.nl (J. J. Lodder) - 2015-03-21 11:10 +0100
                Re: Migrating to new machine Jolly Roger <jollyroger@pobox.com> - 2015-03-21 13:18 +0000
                Re: Migrating to new machine nospam@de-ster.demon.nl (J. J. Lodder) - 2015-03-21 14:40 +0100
                Re: Migrating to new machine Jolly Roger <jollyroger@pobox.com> - 2015-03-21 13:43 +0000
                Re: Migrating to new machine nospam@de-ster.demon.nl (J. J. Lodder) - 2015-03-21 17:33 +0100
            Re: Migrating to new machine Jolly Roger <jollyroger@pobox.com> - 2015-03-20 13:18 +0000
              Re: Migrating to new machine Warren Oates <warren.oates@gmail.com> - 2015-03-20 10:10 -0400
                Re: Migrating to new machine Jolly Roger <jollyroger@pobox.com> - 2015-03-20 14:32 +0000
                Re: Migrating to new machine Warren Oates <warren.oates@gmail.com> - 2015-03-20 11:35 -0400
                Re: Migrating to new machine nospam <nospam@nospam.invalid> - 2015-03-20 12:30 -0400
  Re: Migrating to new machine me@home.spamsucks.ca (Király) - 2015-03-19 16:33 +0000
    Re: Migrating to new machine Jolly Roger <jollyroger@pobox.com> - 2015-03-19 16:40 +0000
  Re: Migrating to new machine nospam@de-ster.demon.nl (J. J. Lodder) - 2015-03-22 10:46 +0100
    Re: Migrating to new machine John McWilliams <jpmcw@comcast.net> - 2015-03-22 13:45 -0700

csiph-web