Create admin user in Single User Mode

Question

Level 1

11 points

Create admin user in Single User Mode

Hi

I have macbook pro md102. I create one admin user for me and one non-admin user for my friend.

Today I notify that my friend can create admin user using Single User Mode, change my admin password, get access to my filesystem and programs.

Why Apple gives root access in Single User Mode and why this mode enabled by default? Can I disable it?

P.S. I have another MacBook 2015 and 'Cmd+S' command doesn't work there.

MacBook Pro (13-inch Mid 2012), macOS Sierra (10.12.3)

Posted on Mar 12, 2017 10:17 AM

Reply

Answer 1

red_menace

Level 6

17,066 points

Mar 12, 2017 11:31 AM in response to detonavomek

The only user in single user mode is the root user - that is the way it is designed. You can restrict access to single user mode, along with other things such as booting from an external volume, by setting a firmware password. Note that physical access trumps pretty much any security measure except for encryption, so you need to choose your security setup (or "friends") with care.

Reply

Answer 2

BobHarris

Level 9

56,933 points

Mar 12, 2017 1:55 PM in response to detonavomek

FYI: Single-User-Mode has existed since the early Unix implementation in the early 70's. So the person you need to ask is Ken Thompson, of Bell Labs

<https://en.wikipedia.org/wiki/Ken_Thompson>

And as red_menace says, physical access gives a person ultimate access to your computer and data. Good Encryption of your data is about the only thing that can stop physical access. For example, the firmware password, can be bypassed by removing the disk from the computer, and accessing it from another computer, then put it back after whatever changes desired are made to it. Encrypting (System Preferences -> Security -> FileVault) means the protections go with the disk and cannot be separated from your data.

Reply