Welcome to the MacNN Forums.

If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below.

You are here: MacNN Forums > Software - Troubleshooting and Discussion > macOS > Weird System Admin

Weird System Admin
Thread Tools
barbarian
Senior User
Join Date: Apr 2001
Location: Palo Alto, CA
Status: Offline
Reply With Quote
Jul 28, 2004, 01:41 AM
 
A user at our workplace logged out of his home computer and found that one of his logged in users was the System Administrator. He claims he did not log in as root and his password is relatively secure (random name + 5 digits) and is not written anywhere.

My question could this have been a system quirk or would someone had to have logged in as root?

Would they have to have logged in physically on the computer to show up in the users pane or could it have happened remotely?
     
wadesworld
Grizzled Veteran
Join Date: Apr 2001
Status: Offline
Reply With Quote
Jul 28, 2004, 01:49 AM
 
Chances are pretty good that the system didn't spontaneously decide to log root in.

With that said, I think the default configuration for SSH is to not allow root to log in remotely (as it should always be).

He should check the output of the "last" command.

Does he have VNC installed or Apple Remote Desktop access turned on? If so, someone could have used Fast User Switching remotely to log in another account.

But incidentally if I came home and found root logged in on my box, I'd yank the Ethernet cable out in a heartbeat and leave it unplugged until I got an idea of what was going on.

There's not really enough information to determine for sure what happened.

Wade
     
barbarian  (op)
Senior User
Join Date: Apr 2001
Location: Palo Alto, CA
Status: Offline
Reply With Quote
Jul 28, 2004, 09:22 AM
 
Here's another question from the same user... in trying to troubleshoot this issue, he put in new passwords both for himself and as root. But when he input his own password he thinks he mistyped so for example if his pass was eskimobread he might have mistyped eskimbread twice so it was accepted but not what he expected and because of this he could no longer log onto his user area.

Anyway the upshot was that he had to log into root to change his user password because however it was that he mistyped it he could not recreate it. BUT the keychain is still on the wrong mistyped password that he can't figure out. If he has root access can he get a keychain password that has been forgotten?
     
Anubis IV
Dedicated MacNNer
Join Date: Nov 2003
Location: Huh?
Status: Offline
Reply With Quote
Jul 29, 2004, 12:29 PM
 
I don't know if you can do that with root since I don't have too much experience using root, but you might consider just booting from the System Disk and then selecting the Change Password option from the menu at the top. That might handle it, or, at the very least, it's another option.
"The captured hunter hunts your mind."
Profanity is the tool of the illiterate.
     
barbarian  (op)
Senior User
Join Date: Apr 2001
Location: Palo Alto, CA
Status: Offline
Reply With Quote
Jul 30, 2004, 01:30 PM
 
He never did find the keychain password, but we had backed up recently so he replaced the keychain file with an old one which allowed him to use the old password.
     
   
Thread Tools
 
Forum Links
Forum Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Top
Privacy Policy
All times are GMT -4. The time now is 12:15 AM.
All contents of these forums © 1995-2017 MacNN. All rights reserved.
Branding + Design: www.gesamtbild.com
vBulletin v.3.8.8 © 2000-2017, Jelsoft Enterprises Ltd.,