Unlocking user account with another user's login credentials

Question

Level 2

217 points

Unlocking user account with another user's login credentials

My daughter recently discovered something on our iBook that I wasn't aware of and it's something that troubles me.

I had my user account logged in but locked out. She opened up the iBook and was presented with the dialog to unlock my account or switch users. Instead of switching users, she entered her user name and her password instead of mine and the computer unlocked my user account for her.

I was unaware that one user could unlock another user's account like that and it was a shock to watch it happen. She told me she could do it and I didn't believe it until I saw it for myself. Is this intentional or do I have a bad install of OS X?

Message was edited by: Rick Anderson

iBook G4, Mac OS X (10.4.11)

Posted on Dec 27, 2008 5:55 PM

Reply

Answer 1

Rick Anderson Author

Level 2

217 points

Dec 27, 2008 5:58 PM in response to Rick Anderson

I just played around with this and discovered something. It appears to work only for admin accounts. Her user account is an admin on the iBook (the iBook can't stay connected wirelessly so everyone needs to be an admin in order to reconnect.) Is there a way to disable this functionality for admin accounts?

Reply

Answer 2

Niel

Level 10

726,881 points

Dec 27, 2008 5:59 PM in response to Rick Anderson

Is this intentional

Yes, if she has an administrator account; it was included because someone shouldn't be able to lock an administrator out of the computer, and if the Fast User Switching GUI isn't enabled, there is no other way besides forcing a shutdown. Click here for more information.

(39261)

Reply

Answer 3

Rick Anderson Author

Level 2

217 points

Dec 27, 2008 6:02 PM in response to Niel

Thanks for the quick response!

Sort of bummer though. The iBook has real trouble staying connected consistently to the wireless network and you can't reconnect without being an admin so I have a bit of a dilemma here. I'm going to research it a little and see if there's a way to disable that ability to unlock accounts for specific users. I'd rather my kids not be able to do it.

Reply

Answer 4

Király

Level 6

10,017 points

Jan 4, 2009 4:34 PM in response to Rick Anderson

Rick Anderson wrote:
Sort of bummer though. The iBook has real trouble staying connected consistently to the wireless network and you can't reconnect without being an admin so I have a bit of a dilemma here.

I'm curious why only admins can re-connect to the wireless network. That doesn't sound right to me.

Reply

Answer 5

rccharles

Level 6

12,957 points

Jan 4, 2009 8:55 PM in response to Rick Anderson

An administrator is allowed to define new users. One of the users is root who can look at any file on the system. Any administrator from the terminal can access any file. With the access to the machine, any user can boot a system's CD and change passwords on userids for instance.

Your best protection is to use filevault.

----------------

You may want to define a new forum entry that explores why you need administrator access to get your wireless connection working.

I do not know the wireless commands, however, you can change the permissions on terminal commands so that any user can run the command. Perhaps you could figure out the terminal command for reactivating you wireless connection and change the permission to let any by use it.

Robert

Reply

Answer 6

Chris CA

Level 10

82,434 points

Jan 4, 2009 10:31 PM in response to Rick Anderson

the iBook can't stay connected wirelessly so everyone needs to be an admin in order to reconnect.)

???
Turn on the Airport and select the network to connect to.
It works for all users. No need for an admin account.

Reply