Saturday, July 21, 2007

User level secruity in Mac OS X

OS 10.4 Security Tip

I would like to shed some light on the different types of user accounts that can be created and operated in OS 10.4. Knowledge of the different account types can help keep your computer secure.

User

The User account is the least privileged account. It allows a user to modify settings for his/her own account but not for others and cannot modify the universal settings. For multiple users of a single system you can further limit user accounts to prevent them from changing system preferences, removing items from the Dock, changing passwords, burning CDs or DVDs or using some installed applications.

Admin

The Admin account can perform many of the operations normally associated with the root user. An Admin account can add or delete User files, but typically cannot otherwise modify the contents of the User file. Admin accounts can modify the System folder by using the Installer or Software Update applications.

Root

The Root user is a superuser (su), which has full permissions for anything. Root users can execute any file and can access, read, modify or delete any file in any directory. Unlike most UNIX systems this superuser Root access is turned off by default and most Mac users will never have to access Root. This protects your Mac from those that might do damage by acting as a root user.

Every user on every computer should have a password assigned to him or her. Many people are always logged into the Admin account by default, which is a security risk.

For an extra level of security, you can do what Morgan at Small Dog does - he creates an Admin account, and then creates his own non- admin user account for himself to use. The Admin account is the first account he creates on his computer, and then he creates the user account. You create the secondary user account in "Accounts" in "System Preferences." Here's how we do it:

  1. Browse to System Preferences > Accounts.
  2. Create a new user, with a new name and password.
  3. Click on the button that says, "Allow user to administer this computer."
  4. Select your previous Account.
  5. De-select the button that says, "Allow user to administer this computer." The non-Admin will have all the data, bookmarks, and software that were created when it was an Admin Account. The Admin won't have this data, but in most cases should not need it.

Even if you've always been logged into your computer as an Admin, it's not too late to go back and demote yourself to user with the instructions above.

If you need both users to have access to all data, there may be some UNIX script that would allow you to do that.

Let me know if you have any other suggestions or queries!

No comments: