If the owner of a Mac hasn't enabled the root account (via NetInfo manager and the usual suspects) then is it possible to successfully execute a sudo'd command to effect root tasks? Why / Why not?
I don't have an unadulterated Mac to test this.
2 Answers
Yes, Mac OS X allows use of sudo when the root account has not been activated. Administrators will be put in /etc/sudoers when their account is created; you can edit it manually to add or remove users the old-fashioned way as well.
The reason is mainly security. As any *nix veteran will tell you, logging in as root when you don't have to is A Bad Idea. As root has read, write and execute permissions for everything, a few errant keystrokes can make a real mess of the computer. This, of course, makes it a favourite target of hackers and malware authors, too. Presumably Apple deactivates root by default to discourage users from logging in as it (perhaps they were used to running as Administrator on Windows, although this is just as foolish as logging in as root) as well as making it more difficult for someone with ill intent to access the root account (if you enable it by default, you either need to use a default password (which can easily be guessed or figured out) or get the user to choose a password (users generally choose crap passwords)). The root user does, however, still exist on Mac OS X, even when it's disabled - all that does is prevent logging in as root (su root, ssh -l root and so on). As you might expect, many processes are run as root, including these launched with sudo.
-
-
@Daniel Beck No, I mean yes. At least in answer to "If the owner of a Mac hasn't enabled the root account...then is it possible to successfully execute a sudo'd command to effect root tasks?". Perhaps it's just not using no double negatives that's ending up confusing each other. :-D– ScottCommented Jun 2, 2011 at 8:31
-
1OK, didn't see that; I was more focused on the title I guess ;)– Daniel Beck ♦Commented Jun 2, 2011 at 8:37
-
@Daniel Beck I see where you're coming from now. :-) You had me all worried that I'd got myself mixed up.– ScottCommented Jun 2, 2011 at 8:39
By default, administrative users will be able to use sudo, non-administrative users will not. You can customize this by editing /etc/sudoers if you want to.
-
1I'll add that the recommended way to edit the sudoers file is "sudo visudo", which double-checks that you don't break the file when you save your change.– SpiffCommented Jun 2, 2011 at 4:46
sudois the same one I use to log in. Then again, it may be that long since I set up my Mac and I don't remember enabling root.