I'll add to the equation that, if you use a strong password containing more than 12 characters, typing your admin password repeatedly eats up a lot of time and patience. It just isn't very practical from a productivity point of view.

Exactly -- I want two forms of the same account; not two accounts.

I understand what you want, and to some degree you do have that with su, but not completely. You may be better off working in an admin account. You could hop into the current admin and set yours to admin, do your work, and then switch it back, but that's a hassle. Maybe a script would help?

On the other hand, I think that "most folks" aren't aware of scripting, or even this site. They're using admin accounts and don't even know it. They definitely should be using standard accounts. My wife and her sister are good examples of people who never go into their admin accounts. They have no need.

I've come to the same conclusion, CWT -- I've switched my normal account back to Admin and left the new Admin account I created virgin -- I can use that for checking whether I have a problem peculiar to my normal account.

Just as a precaution, it might be advisable to create the file "/Library/Preferences/com.apple.SystemLoginItems.plist", make sure it is owned by "root" and lock it. That will at least block this route of passwordless privilege escalation since Apple doesn't seem to be in any hurry to patch it despite the reports of the existence of malware using it.

The funniest thing about all this is that people do come up with complex passwords, get frustrated with having to remember and enter them to make changes to their computer, but if malware were to get running somehow, it wouldn't even need the password to take over their system at all.

Sounds like good advice -- if I knew how to do it or what it did.

I've just noticed that you can upgrade a standard account to an admin account right from the Accounts preference pane if you've got another (and you should!) admin account. It appears that you can temporarily give yourself admin rights when you need them, and then remove them when you're done.

Yes, but if you analyze the situation, you'll see that it probably won't save the user much time or energy to do it like that. They'd have to authenticate with a password and convert their account to admin just to (for example) change a label in their apps folder to orange. After they are finished doing that, they convert back to a standard account, and at the next admin required task, they'll have to repeat the process. For me, this might happen half a dozen times or more per logged in session. On top of that, if memory serves correctly, you must log out and back in again after converting your account to standard or admin "for this change to take effect".

It seems quicker to keep the account standard, and use something like su in the Terminal, or just authenticate in the pop-up dialogue boxes.

hayne's advice (from the thread that I linked to earlier):

Either way, it boils down to how often you need access. Hopefully, if you need access frequently, you also know how to protect your system while you're logged in as an admin.

Come to think of it, security card based authentication would cut dow on most of the typing. Does anyone have experience using one of these systems under Mac OS?

The (former) post 15 has been deleted as requested.

Trevor

This is what the list of "sudoers" is for (mentioned earlier). When you sudo, you're executing an action as your own user, but with elevated permissions. AFAIK, this is all that is meant by using an "admin" account on a Mac -- it's why you'll have to authenticate for system-changing actions, and it's why you'll have to authenticate again after a while. Admin != root. Apple seems to have implemented the standard sudo behavior on this one, as far as I can tell.

If, on the other hand, you had the root account enabled, and logged in under that one, it would be very similar to logging into any Linux/Unix GUI as root, which is generally unneccesary.

However, if you enable the root account, and use the terminal to su to root (from your standard or admin account), you'll still have the proper permissions to view and change your standard user's files (or any other user on the Mac), without hassle. Be careful, however, to ensure that file permissions don't get set to root-only on any files you edit, and if they do, just change them back with chmod or chown. Also, if you're using X11 and plan to open an X11 window with root permissions, you may need to adjust your X11 authentication to allow it.

This looks like it might be the way to go, but I don't know how much it would cost, or where to get a card reader system. The passage was found in the recently published Leopard Security Configuration Guide 2008.

I would like to do this but I cannot figure out the syntax. How about an example.

Robert