[ChadC]

I am trying to SSH into the localhost with the root user. I assumed the password was the same as my Administrator password, but it isn't.. Is this is a default password that I should, but dont know? If not is there anyway that I can reset the password?

This is the line i use

ssh root@localhost

Any help?

Thanx,
Chad

[Wevah]

You can't SSH into anything as root. SSH in with your administrator account and use sudo.

[oscar]

Why do you need to ssh in? id just type su <enter>

[Earth Mk. II]

you can enable remote access as root in the sshd.conf. But with su and sudo, there's little reason to turn it on.

[Cadaver]

Be VERY careful with what you do with the SUDO command. You can really screw up your machine if you don't know what you're doing.

[Xeo]

And root is disabled in OS X by default. You'd need to enable root before you can "su". But you can, and IMO should, just use sudo for everything you need admin privileges to do. If you really need a root shell, just do sudo -s. Then it's the same as your admin password, that you already know.

[ChadC]

I figured out how to enable root through NetInfo manager last night after hours of just clicking around. I need to SSH because I am trying to go through this tutorial http://www.phpmac.com/articles.php?view=201 to install phpMyAdmin on my computer so I can manage my MySQL database which i thought i had correctly installed, now I am not sure because after following the directions that come with MySQL to install, I now have no idea how if it is or isnt working, beyond that I don't know any of the passwords(i.e. the built in mysql account in OS x.3) to even set up a database through the terminal. So at this point I am just lost in MySQL and am trying to find my way out. Thanx for the input though guys, I appreciate it.

[larkost]

You don't need to enable root. Use 'sudo'.

[Millennium]

There are actually two levels of disabling going on here. OSX disables logging in as root, because it is dangerous. However, even if that is enabled, SSH also disables logging in as root, for the same reason.
The easiest thing to do is to log in as an Administrator and use sudo to do what you want. If you absolutely, positively need a root shell, then sudo -s will do the trick.

[mcsjgs]

I'd like to ask a devil's advocate question about "root". When I first started using OS X 17 months ago, the first thing I thought about root is that is nuts to leave it disabled without a password. So I enabled it.

I never had any problems until I reinstalled Panther and left it disabled because every expert I read said no, no, no don't enable root. Then I had a problem which was 99.999% totally unrelated to root being disabled.

After the problem, I read in "Absolute BSD" by Michael Lewis on page 17 "To begin, set a root password. If you don't have one, any doofus can log into the system as root without using any password. (Since root has absolute control over your hardware and software, this would be bad)"

Granted there are big differences between Mac OS X and FreeBSD. Granted there can be horrific screwups using root access unless you know exactly what you are doing.

But is Lewis's point valid? Can the root password be set by any doofus who gains access to your system?

[Millennium]

Originally posted by mcsjgs:
But is Lewis's point valid? Can the root password be set by any doofus who gains access to your system?

No. Only root can change root's password, and it can't do that if it can't log in (root login is disabled in OSX by default).

Administrators can use their sudo access to change root's password, and so if someone gets access to their Administrator accounts then they could change root's password. However, this would hold true even if root's password is set, because [b]sudo[/i] works by letting the user act as root for one command.

[mcsjgs]

Originally posted by Millennium:
[B]No. Only root can change root's password, and it can't do that if it can't log in (root login is disabled in OSX by default).

Administrators can use their sudo access to change root's password, and so if someone gets access to their Administrator accounts then they could change root's password. However, this would hold true even if root's password is set, because sudo[/i] works by letting the user act as root for one command.

I am not too keen on Apple's implementation of sudo in OS X after reading up on it a bit. Perhaps the time interval after sudo is used needs to be drastically shortened (30-60 seconds?) You can always issue commands in BSD for a sudo session if that is what is needed and if I am understanding this correctly.

Edited: I stand corrected. It is a BSD implementation not Apple-specific, so please ignore "Apple's implementation" above.

[samm]

Originally posted by mcsjgs:
I am not too keen on Apple's implementation of sudo in OS X after reading up on it a bit. Perhaps the time interval after sudo is used needs to be drastically shortened (30-60 seconds?) You can always issue commands in BSD for a sudo session if that is what is needed and if I am understanding this correctly.

Edited: I stand corrected. It is a BSD implementation not Apple-specific, so please ignore "Apple's implementation" above.

Anyone with sudo privilages should be treated like root. Since they can launch a shell and instantly have root privilages. I don't think using a shorter or longer time interval would matter in this case.

g4:~ samm$ sudo bash
Password:
g4:~ root#

[mcsjgs]

Originally posted by samm:
Anyone with sudo privilages should be treated like root. Since they can launch a shell and instantly have root privilages. I don't think using a shorter or longer time interval would matter in this case.

g4:~ samm$ sudo bash
Password:
g4:~ root#

Perhaps this function should be off by default in OS X with the adminstrator having to expressly grant permission for a user and logging the use? With a clear explanation of what is being granted? You can't make it failsafe, but you can improve it so it would at least require some social engineering. If an intruder has access to an adminstrator or root account, all bets are off, of course.

[wadesworld]

Originally posted by mcsjgs:
Perhaps this function should be off by default in OS X with the adminstrator having to expressly grant permission for a user and logging the use? With a clear explanation of what is being granted? You can't make it failsafe, but you can improve it so it would at least require some social engineering. If an intruder has access to an adminstrator or root account, all bets are off, of course.

I'm a little confused on what the big deal is.

Why would anyone assume that "Administrator" accounts do not have total access to the machine?

Why would you give an administrator account to anyone you don't trust?

If it bothers you, why not just modify sudoers so you're the only person on the machine that can sudo?

Wade

[Angus_D]

Originally posted by wadesworld:
If it bothers you, why not just modify sudoers so you're the only person on the machine that can sudo?

Because that won't limit their ability to become root. Off the top of my head:
1) SecurityServer's system.right.execute is configured to allow those users in the admin group to execute arbitrary tools as euid=0 via AuthorizationTrampoline.
2) I believe that Directory Services assumes users in the admin group should be able to modify the local NetInfo node, either directly or with the set password authentication methods.

[Angus_D]

Originally posted by mcsjgs:
But is Lewis's point valid? Can the root password be set by any doofus who gains access to your system?

No, it's not. The root account is DISABLED by default in OS X. This means that it IS IMPOSSIBLE TO LOG IN AS IT, not that it has no password. Giving root a blank password is incredibly retarded, but having the root account disabled is more secure than giving it any possible password.

Only administrator users can change root's password. If a user has administrative rights (i.e. is a member of the admin group), all bets are off.

[Angus_D]

Originally posted by Millennium:
No. Only root can change root's password, and it can't do that if it can't log in (root login is disabled in OSX by default).

That's not entirely true. Admin users have the right to modify the underlying data store for the local node even if they don't have euid 0, and they also have the right to gain euid 0 at which point they effectively are root.

So any admin user can change root's password.

[mcsjgs]

I guess I was somewhat shocked to learn what administrators can do even with root disabled via sudo due to my dismal unix iq. Unix is great, but the possibilities are almost endless. Thanks for my seniors in pointing this out to me.