Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

pianoman1976 Author

Level 1

104 points

Wheel Group

I have noticed a trend that when on very seldom occasion some strangeness is going on with my system - the wheel group keeps popping up. This group seems to have unrestricted access - therefore I associate it as being a threat. I'm wondering what the normal ops standard is with this group. Is it normal to see this group throughout my system?

Is it normal that all downloaded files have wheel group permissions set?

"One cannot log into a machine remotely via telnet as root (unless root has no password), and therefore users who wish to obtain root access remotely must first log in as a normal user and then use su to gain root access. By restricting wheel access you can therefore reduce the probability that a compromised account will result in an intruder obtaining privileged access via the network."

How do I restrict wheel access?

Message was edited by: pianoman1976

iMac 2.4 GHz Intel Core 2 Duo, 4 GB SDRAM, Mac OS X (10.5.6)

Posted on Jan 3, 2009 11:42 AM

39 replies

baltwo

Level 9

62,362 points

Jan 10, 2009 11:57 AM in response to pianoman1976

Before updating to 10.5.6, get a bootable, external HD (preferably FireWire, since it's 40-50% faster than USB 2 and designed for data transfers), make a bootable backup/clone before updating/upgrading, and ensure that it's bootable and works like the original. That allows you to revert to the previous good state without having to reinstall anything. See these for details:

http://docs.info.apple.com/article.html?artnum=106941
http://www.macmaps.com/upgradefaq.html
http://www.macmaps.com/backup.html
http://www.thexlab.com/faqs/installswupdates.html
http://www.thexlab.com/faqs/backuprecovery.html

pianoman1976 Author

Level 1

104 points

Jan 22, 2009 1:49 AM in response to baltwo

I'm wondering why and how my home directory has wheel instead of staff permissions after I run the 10.5.6 combo updater?

I shouldn't have to manually sudo chgrp -v -R staff ~/ to set things the way they should be set.

baltwo

Level 9

62,362 points

Jan 22, 2009 11:11 AM in response to pianoman1976

I don't have a clue, since mine shows group = staff on mine. The only user folder with wheel is Shared. You're correct, you shouldn't have to fix it.

pianoman1976 Author

Level 1

104 points

Jan 22, 2009 11:15 AM in response to pianoman1976

I guess I do know the "why" I just don't know the "how".

The "why" is a somewhat sensitive subject, as it involves the Patriot Act.

baltwo

Level 9

62,362 points

Jan 22, 2009 12:20 PM in response to pianoman1976

Only you know the environment where the machine is running.

pianoman1976 Author

Level 1

104 points

Jan 22, 2009 1:58 PM in response to pianoman1976

I don't mind the looking, in fact I wish it could be done without me knowing - this is how it should be. God forbid I actually was a threat to national security. There should be better protocols that are more inconspicuous that don't compromise the operation of target computer.

Thanks for the assistance. 😉

Jan 22, 2009 2:41 PM in response to pianoman1976

You should fix the wheel issue for your home directory.

Go into Terminal and type this command: *sudo chmod -RN ~*

Than, boot off your Install DVD and choose Reset Password. Than find "Reset Home Directory Permissions and ACLs"

That should fix the permissions.

pianoman1976 Author

Level 1

104 points

Jan 22, 2009 2:53 PM in response to Community User

sudo chgrp -v -R staff ~/ seems to work just fine.

I have a few questions about your recommendation. I was familiar with sudo chmod -RN, but the way I learned it was to include a folder after -RN /

I don't know much about unix. So I gather the '~' takes care of all folders? If not, what does it do?

Doesn't sudo chmod -RN not only clear ACL's but also give the user full permissions control?

I too am somewhat familiar with the Reset Password ACL fix you mentioned using the Install DVD. What is purpose of doing sudo chmod -RN before doing this?

Message was edited by: pianoman1976

Jan 22, 2009 2:56 PM in response to pianoman1976

The ~ represents your home folder. You do not want to remove ACLs outside of it, plust that is where you are still having issues.

*sudo chmod -RN ~* will recursively remove ACLs in your home folder.

As for doing both, I'm not sure exactly what you did, but the command removes ACLs, and than the DVD utility will set the permissions to how they should be.

Wheel Group