OS X 10.4 Security Tip

Here are the different types of user accounts that can be created and operated in OS 10.4. Knowledge of the different account types can help keep your computer secure.

1) The User account is the least privileged account. It allows a user to modify settings for their own account but not for others and they cannot modify the universal settings. For multiple users of a single system you can further limit user accounts to prevent them from changing system preferences, removing items from the Dock, changing passwords, burning CDs or DVDs or using some installed applications.

2) The Admin account can perform many of the operations normally associated with the root user. An Admin account can add or delete User files, but typically cannot otherwise modify the contents of the User file. Admin accounts can modify the System folder by using the Installer or Software Update applications.

3) The Root user is a superuser, which has full permissions for
anything. Root users can execute any file and can access, read, modify or delete any file in any directory. Unlike most UNIX systems this superuser Root access is turned off by default and most Mac users will never have to access Root. This protects your Mac from those that might do damage by acting as a root user.

Every user on every computer should have a password assigned to him or her.

Many people are always logged into the Admin account by default, which is a security risk.

For an extra level of security, you can do what Morgan at Small Dog does – he creates an Admin account, and then creates his own non-admin user account for himself to use. The Admin account is the first account he creates on his computer, and then he creates the user account. You create the secondary user account in “Accounts” in “System Preferences.” Here’s how he does it:

1. Browse to System Preferences > Accounts.

2. Create a new user, with a new name and password.

3. Click on the button that says “Allow user to administer this computer.”

4. Select your previous Account.

5. De-select the button that says “Allow user to administer this computer.” The non-Admin will have all the data, bookmarks, and software that was created when it was a Admin Account. The Admin won’t have this data, but in most cases should not need it.

Even if you’ve always been logged into your computer as an Admin, it’s not too late to go back and demote yourself to user with the instructions above.

If you need both users to have access to all data, there may be some UNIX script that would allow you to do that.

Let us know if you have any other suggestions!