4

To those unfamiliar, the Mac OSX has the root account disabled by default. In order to enable the root user you have to go deep into System Preferences and authenticate yourself with an administrator name/password. This makes sense that you would want to leave something as powerful as root disabled by default. Then, when you wish to actually use root, you need to sign out of your account and login under the "root" account name.

However, according to this official support page [apple.com]:

To ensure the security and stability of your computer, disable the root user when you are not using it.

At first I thought they simply meant to log out or exit the root account when done, but that doesn't seem to be the case based off how they explicitly said "disable the root user." By their suggestion, whenever I want to use root I must go through the hassle of enabling/disabling root it in addition to signing in/out of the root user.

Does this seem like a complete waste of time to anyone else, or am I missing something here? Are there legitimate security/stability risks that I am leaving myself open to by not disabling the root user?

Improve this question
4
  • Moses, can you clarify if you're using this at home or at the office, or both?
    – chuacw
    Apr 17, 2012 at 2:17
  • This is for my home computer.
    – Moses
    Apr 17, 2012 at 2:32
  • Moses, since this is at your home, I think it is safe to enable the root account. BTW, who or what is a threat to your home machine? Or is this a work machine at home?
    – chuacw
    Apr 17, 2012 at 3:53
  • @chuacw my home machine might also function as a local server, vpn, etc. These leave me open to attack if I don't take the proper precautions.
    – Moses
    Apr 17, 2012 at 14:31

2 Answers 2

Reset to default
7

I don't see the quoted instruction on that Apple KB article; the closest I see is:

After completing a task as the root user, you should log out of Mac OS X and log back in using a normal or administrator account. You should disable root access if you do not use it often.

Which seems (to me) like reasonable advice. Having the root account enabled is not a serious security risk (provided you follow good password practices), but it's usually an unnecessary security risk.

The biggest problem with having root enabled is that it's the most tempting target around for password-guessing attacks. For example, if you have SSH enabled & accessible from the internet, you will have bots connecting and trying to guess the root password.

Basically, having root disabled decreases the number of ways for someone to take over your computer; so unless you need it, leave it turned off.

Improve this answer
4

IMHO there is no practical reason for having the root account enabled

  • At the command line, if you need extra powers you are supposed to work with the sudo command. If you need to do it for many commands, use sudo -s that basically creates another session where you are effective root until you exit. Each sudo usage requires your user password to run.

  • On the GUI you configure your user account to be "administrator" and each time you need to do something "privileged" you are asked for your password.

As for the risk of having the root account enabled, it creates another path into your system (@Gordon above said it all) and another level of complexity to your life (plus another password to remember...)

Improve this answer
3
  • My goal was to be able to sudo from non-admin accounts without having to su into an admin account. However, I cannot seem to find any way to su to root from the terminal (thus defeating the purpose of having it always enabled).
    – Moses
    Apr 17, 2012 at 14:27
  • I would suggest to add that a security professionnal would always type /usr/bin/sudo so as to avoid to fall in the wrong sudo if he uses . in his PATH for legitimate reasons.
    – dan
    Jul 4, 2015 at 15:08
  • "complexity to your life" += another entry point to monitor.
    – dan
    Jul 4, 2015 at 15:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .