Authors: Adam Gray cism

səhifə	2/11
tarix	25.06.2016
ölçüsü	279 Kb.

1 2 3 4 5 6 7 8 9 10 11

Types of User Accounts and Account Philosophy

With any type of account there are several general guidelines to follow in order to help maximize the security of the multi-user environment. Apple uses several types of user accounts on OS X. Account types include the guest account, administrator account (also known as root), administrator accounts, accounts managed with parental controls, sharing only accounts and standard user accounts.

The guest account, standard user account, the managed non-Administrator account, and the administrator account are all allowed to logon using the graphical interface. We’ll talk more about the system administrator account (root) below but it is worth noting that when enabled it can also log on at the login window. As with most types of computer and network security the least privileges required for a given task should apply and with user accounts it is more critical than with almost any other aspect of the system. If an account does not need administrative privileges then that account should not have administrative privileges. Likewise, if an account doesn’t need access to log into the system except through file sharing then that user should have a sharing only account.
Never share accounts. Shared accounts make it difficult to monitor and detect malicious activity. Malicious actions often go unnoticed and changes are often ignored by other users on a system. Shared accounts also harm accountability: there is no clear audit trail as to who performed a specific action.
Use a standard user account for daily operations. Administrator accounts should only be used for operations that require administrative privileges. Administrator privileges are required for tasks like installing software, running updates and configuring various settings in the operating system. When running as an administrator, malicious software could affect the operating system or applications. Malicious software is often not able to exploit a given system if the local user executing the code does not have sufficient privileges to install or change the configuration of the system. Administrator accounts should not be used for writing documents, checking e-mail or browsing websites. Administrators of systems should always keep the segregation of duties when dealing with administrator and user actions.
User IDs are another item to be concerned with. This concept is identical to other UNIX operating systems. The acceptable user ID range is 501 to 2,147,483,648. By default, new users on a system are assigned a number starting at 501. If multiple users are created on a system or are part of a shared network, be sure that user IDs are unique for individual users through the entire system. User Ids are the underlying component that is checked for rights and privileges.

Securing Administrator Accounts

The first account created on a new installation of Mac OS X is an administrative account. This allows the owner of the computer to accomplish many of the tasks that are often performed with a computer. This default setup should be changed. The first step is to create a new account for administration:

Open the System Preferences application.
Click on the Accounts icon to open the Account System Preference Pane.
If locked, click on the padlock to allow changes and authenticate.
Click on the plus sign to create a new account.
In the drop-down list for New Account: select Administrator in the list of account types.
Type in the name of the account you wish to use for administrative purposes.
Type a password and the password verification.
Click on the Create Account button.

The next step is to remove the administrative privileges from the user created during system setup. With the account administration program still open:

Click on the account that was created during the install.
Uncheck the Allow this user to administer the computer check box.
This will prompt for a user name and password. Supply the username and password from the administrator account created in the last step.
Click the open padlock icon to lock out further changes.

With these two steps done the first steps for separating privileges is complete. To emphasize this yet again, the new account with administrative privileges should only be used for administration and not day-to-day activities.

Next, create any accounts that will only have access to remotely log into the system for the purpose of sharing files. To create an account that cannot log into the desktop but can only log in to share files:

Open the System Preferences application.
Click on the Accounts icon to open the Account System Preference Pane.
If locked, click on the padlock to allow changes and authenticate.
Click on the plus sign to create a new account.
In the drop-down list for New Account: select Sharing Only.
Enter the name of the account you wish to grant sharing access to.
Type a password and the password verification.
Click on the Create Account button.

Part of what makes it possible to use Mac OS X with a non-administrator account, and yet still convenient to make administrative changes has to do with the way that Mac OS X allows and authorizes what it considers to be administrative tasks.

First, we have sudo – a standard in the Unix environment. This terminal command allows accounts to run commands as another account (usually root). For example, in the Terminal application, if you typed in “/sbin/reboot” you’d get an “Operation not permitted” message, and nothing would happen. If you typed in “sudo /sbin/reboot”, you would be prompted for your password, and then if you are an administrator the system would proceed to reboot (by default, if you aren’t an administrator, sudo will provide you with an error about your privileges and fail to execute the command). Sudo is controlled by the /etc/sudoers configuration file, and is a pretty simple configuration on OS X. Essentially, the root account (which is covered below) and anyone in the admin group (all of your administrative accounts) can run anything they want. By default, no one else can run anything. Sudo is capable of much more granularity than this. View the man page for sudoers for more information on customizing your sudoers file.
Apple has another mechanism for administrative tasks through the GUI. The system will prompt you for credentials any time you try to do something the system considers administrative. The ID and password of a valid administrative account will be required to perform that task. This allows you to be logged in with a non-administrative account, and temporarily escalate your privileges before you go back to doing non-administrative activities. Sudo has a 5 minute default cache, meaning that as long as you run a sudo command at least once every 5 minutes you aren’t re-requested to authenticate. The GUI authentication mechanism has no such cache, so if you perform 3 administrative tasks within a 45 second time period, you will be prompted for credentials 3 different times.
This is similar to the runas command in Microsoft Windows 2000 and higher, but with a couple of key differences. First, in Windows you need to know that you need administrative privileges to do something and consciously right click on that action and select run as. In Mac OS X, you just perform the task as if you were the administrator and if administrator credentials are needed, Mac OS X will usually ask you for them.
Second, Apple has done a good job of identifying the tasks requiring administrative privileges. This is done in part within the context of the account property list files (plist files), file permissions and the sudoers file. If an item has privileges that your account cannot access then it can be accessed in this manner. As more applications for Mac OS X become available, applications that require credentials become a user’s wakeup call that something is trying to make a change to their system.
Secure your administrator accounts, don’t use administrator accounts for daily activity, and understand the two common ways to do administrative tasks on OS X and you will be well protected from Trojans and the accidental deletion of various files.
Also, if an account only needs access to a system via a network connection use a Sharing Only account. The Sharing Only account type does not authenticate through the login window and so minimizes the risk of unauthorized access to your system.
Finally, Parental Controls have been greatly improved in Mac OS X 10.5. Use a Managed with Parental Controls account in order to lock down certain features of Mac OS X. You can also build custom mcx files to further secure managed accounts. You can leverage the mcx framework by using the –mcximport extension of the dscl command. Using mcx it is possible to lock down nearly any feature of Mac OS X at the user or group level. An mcx can be set using Workgroup Manager and then imported through the dscl – mcximport command in much the same way you can set local policies in Windows using poledit, for example.

1 2 3 4 5 6 7 8 9 10 11