PDA

View Full Version : administration account?



elliptrical
15th July 2007, 08:13 AM
I was searching for general 'getting to know your mac' info and came across this article in the Tao of Mac. In the DONTS section it says this:

Don't use the administration account for anything other than setting up the machine and applications or changing "permanent" settings (if you want to, say, change network settings as a normal user you'll be prompted for the admin password, and since you'll do configuration changes less and less often as time progresses, this isn't a problem).

Does anybody know what this means? When I shut down my mac I never log off my name so I'm assuming that I'm still working off the admin account. Right? :o

The more I look into this mac the more I find some very interesting yet confusing stuff. My brain hurts:D

Goodbye
15th July 2007, 08:32 AM
AFAIK nearly everyone uses the Admin account, especially those here on MTAU, without any ramifications. But someone with more knowledge of the subject will be able to shed some more light...

vicmeldrew
15th July 2007, 08:53 AM
The guys at Tao of Mac are just being paranoid. If a hacker gets access to your account they can't install anything if that account is not an admin one. But since you have a Mac, that ain't likely, if possible anyway.

Currawong
15th July 2007, 10:48 AM
The idea of not using an admin account is that it's less likely serious damage will be done if you did run malicious software unintentionally.

fummilla
15th July 2007, 12:24 PM
There is a nice touch in OS X which allows you to create an administrators account that does not appear as a login option.

Create an account with the name Administrator and a short name of Admin (case is important) then give that account admin rights. You've created an account just for managing the machine, but without creating all the associated user files, disc space and login options of a normal account.

soulman
15th July 2007, 12:46 PM
I have always run in an admin account but I changed recently and found it pretty painless. Given that it doesn't affect my day to day operation too much and it does add another level of security, I see no reason not to run as a standard user.

I had always had two admin accounts - my normal working one & an alternative one for troubleshooting. All I did was uncheck the "Allow user to administer this computer" checkbox and kept working in the account I'd always used. I do have to enter an admin shortname & password more often but I know them well & the shortname is short. It's only very occasionally that I run into hassles with it and I have fixed them all quickly to date.

The guy who suggested this also recommends keeping one's documents in encrypted disk images - he has separate ones for different areas of work - and having multiple keychains also but I don't think I'm so interesting that people would want to go to a lot of trouble to get at my stuff.

elliptrical
15th July 2007, 03:04 PM
Ok, I'm so way out of my league here that I'm really lost with what you're all saying.
I think your saying generally that it's ok to work as the administrator each time and that this gives further security. How do I set my mac to ask for my login details everytime? At the moment it lets me straight in--no password needed. The only time I ever needed a password was when I set up Airport extreme and downloaded some software updates. Once again, sorry for the newbie questions.

Disko
15th July 2007, 03:12 PM
There is a nice touch in OS X which allows you to create an administrators account that does not appear as a login option.

Create an account with the name Administrator and a short name of Admin (case is important) then give that account admin rights. You've created an account just for managing the machine, but without creating all the associated user files, disc space and login options of a normal account.

I was just about to add this tip to the thread. It is very handy, especially for remote administration.

One thing is, that all other accounts have to be 'standard' or your admin account will show up.

MacDave
15th July 2007, 03:24 PM
IMHO, not running in an admin account is just an admission that you don't trust your own actions.

Dave

toholio
15th July 2007, 03:37 PM
IMHO, not running in an admin account is just an admission that you don't trust your own actions.


Every experienced admin and Linux user who has ever tried to explain to a newbie why you don't want to be root all the time just put their heads in their hands and wept.

At least administrator accounts on OS X need to sudo for anything really silly.

MacDave
15th July 2007, 03:51 PM
Every experienced admin and Linux user who has ever tried to explain to a newbie why you don't want to be root all the time just put their heads in their hands and wept.

At least administrator accounts on OS X need to sudo for anything really silly.


Well, we're not discussing Terminal here and the use of "sudo". A standard user can delete their home directory and that's damage enough. Also, let's keep in mind the difference between an admin user account and a System Administrator account. Running in the latter -is- foolhardy. Running in a passwordless admin account is reckless as well.

However, for a normal user who regularly updates the OS and bundled apps in SU, installs applications from pkgs/mpkgs (which always require an admin password,) it's just a genuine pain the ass to switch back and forth from a standard user account to an admin account even with fast user switching.

In general, standard accounts are what one sets up for OTHER users of their OS X boxes.

Dave

MacDave
15th July 2007, 03:53 PM
Ok, I'm so way out of my league here that I'm really lost with what you're all saying.
I think your saying generally that it's ok to work as the administrator each time and that this gives further security. How do I set my mac to ask for my login details everytime? At the moment it lets me straight in--no password needed. The only time I ever needed a password was when I set up Airport extreme and downloaded some software updates. Once again, sorry for the newbie questions.


To do as you wish, you go to System Preferences -> Accounts. Then, click on the lock in the lower left corner and enter your admin password. Next, click on the House with "Login Options" to its right. You'll see what to do from there.

Dave

soulman
15th July 2007, 04:00 PM
I think your saying generally that it's ok to work as the administrator each time...Some people are saying this. Some of us disagree with that. I'm in the latter group.


and that this gives further security.No, working as a Standard User gives you an extra level of security. Admin users can do more things, so, theoretically, if someone hacked into your computer and/or sucked you in to downloading some malicious software or similar, then an admin account is more vulnerable because it can do more things without requiring a password. Hope that makes sense.


How do I set my mac to ask for my login details everytime?System Preferences->Accounts->Login Options (bottom left) -> Uncheck "Automatically log in as..."

Feel free to post again if you need more info. That's what we're here for.

soulman
15th July 2007, 04:03 PM
...However, for a normal user who regularly updates the OS and bundled apps in SU, installs applications from pkgs/mpkgs (which always require an admin password,) it's just a genuine pain the ass to switch back and forth from a standard user account to an admin account even with fast user switching...That would be a pain in the arse. It's a good thing you don't have to do it. Just typing an admin shortname & pass gets the job done.

toholio
15th July 2007, 04:19 PM
However, for a normal user who regularly updates the OS and bundled apps in SU, installs applications from pkgs/mpkgs (which always require an admin password,) it's just a genuine pain the ass to switch back and forth from a standard user account to an admin account even with fast user switching.


That's all well and good but what I was actually responding to was your "you don't trust your own actions" statement. There are lots of good reasons not to trust your own actions. Everyone makes mistakes from time to time even while doing mundane things. Lots of Linux newbies learn about the pain of making trivial mistakes as root only because they log in as root out of habit. Like I said though, at least OS X requires the use of sudo (or its GUI equivalent) for anything really important.

Also, if your examples above require a password anyway, just type in an admin's username at the same time. No need to switch users.

ShadowDan
15th July 2007, 05:59 PM
Yeah I agree well said Toholio, When my Imac arrives I'll be creating a standard user account just for me, and an admin account for installing programs and for changing settings if need be. I don't see any advantages to running any admin accounts full time.

elliptrical
15th July 2007, 08:32 PM
Some people are saying this. Some of us disagree with that. I'm in the latter group.

No, working as a Standard User gives you an extra level of security. Admin users can do more things, so, theoretically, if someone hacked into your computer and/or sucked you in to downloading some malicious software or similar, then an admin account is more vulnerable because it can do more things without requiring a password. Hope that makes sense.

System Preferences->Accounts->Login Options (bottom left) -> Uncheck "Automatically log in as..."

Feel free to post again if you need more info. That's what we're here for.

Thanks soulman--that does make sense. I'll do some more reading elsewhere as well. For now I'll leave it until I get it--if you get my drift.:p

Thanks for the support!

Did I mention, luuurv this mac:D