Mac Management Group

 View Only

How Does Disabling the Mac Root User Affect the SMP Agent for Mac 

Feb 25, 2014 03:37 PM

Short answer:

Disabling the Mac root user via the Directory Utility app or equivalent command line has no affect on the SMP Agent for Mac installation or subsequent functionality.

Long answer:

The Mac OS X Directory Utility, located at /System/Library/CoreServices/Directory Utility.app, has the option to enable or disable the root user on a mac. The common thought is that disabling the root user in the Directory Utility will disable the root user everywhere on the system and perhaps impede the ability to install the SMP Agent for Mac or break it’s subsequent functionality. That is not true.

Disabling the root user in the Directory Utility will only disable the ability to login at the GUI login screen as the root user. When the root user is enabled, it is possible to switch users at the GUI logon screen, click ‘other…’ and enter ‘root’ and the root user password to login. After doing so, elevated privileges are granted. Examples of elevated privileges can be found in the System Preferences app. A root user entering “Security & Privacy”, “Users & Groups”, etc., will not need to click the lock icon to authenticate while a non-root user will need to click the lock and authenticate in such places. It’s a common security practice in the Unix, Linux and Mac world to log in as a non-root user and use ‘sudo’ or to authenticate before performing functions that impact the system. This way, it’s not as easy to execute commands that delete, disable or otherwise negatively impact the system. At least, that’s the hope.

Disabling the root user does not disable root functionality at the OS or shell level. If it were to disable the root user at the shell level, then the OS would likely break since most OS-level functions need to run with full root privileges. The root user is still alive and functioning at the shell level by necessity. 

Regardless of the state of the root user in the Directory Utility, it is always possible to switch to the root user at the shell level since it is never disabled at that level. That is why using ‘sudo’ at the shell level in the Terminal app still works. When the SMP Agent for Mac is installed, it switches to the root user and installs the agent with root privileges. Any subsequent SMP Agent processes that need to run with root privileges will do so.

There is no need to be concerned with customers disabling the root user in the Directory Utility. It is a perfectly acceptable security configuration for any customer and does not impact the SMP Agent for Mac.

Note: It may be possible to place some restrictions on the root user on a Unix, Linux or Mac system. That is separate from enabling/disabling the root user in the Directory Utility. Restricting the root user or various executables is not a supported configuration for running the SMP Agent for Mac. We require a default, unrestricted root user configuration for proper functionality regardless of whether it is enabled or disabled at the GUI interface level.  

Statistics
0 Favorited
0 Views
0 Files
0 Shares
0 Downloads

Tags and Keywords

Related Entries and Links

No Related Resource entered.