4 ms·
No, root is root and has always been there. It's the super user account and cannot be removed, I think, from any modern unix like os (well, you can rename it to
by biktor_gj 9y ago
No, root is root and has always been there. It's the super user account and cannot be removed, I think, from any modern unix like os (well, you can rename it to whatever you want in linux but UID 0 will always be there). The difference might be that if you do log in for the first time you will have lots of stuff on /private/var/root (talking from memory but it was something like that in OSX) and lots of preferences will be set, maybe even a /Users/root folder
I hope that the SSH server, which is disabled by default, will also handle root login in a sensible way, but given the size of the f* up, I'm not so sure.
Really bad stuff
- ztjio 9y agoRoot can absolutely be disabled. OS X normally runs rootless. This vulnerability actually both gives access AND enables that disabled root account in one action. From that point on, root is active with no password regardless of how you authenticate whereas the initial issue is only on password GUI screens.
- biktor_gj 9y agoNo, by default, root has an undefined password and cannot log in from a terminal or ssh, but that doesn't mean it doesnt exist. If you make a SSH key for the root user and place it on his folder you wont need to set up a password and will be able to login just fine as UID 0. If you do 'sudo -s' as an administrator and then run 'passwd' to set the root passwd, you're not magically creating a root account, you're only changing the settings for that user, but it was already there