Mac OS X Security: Never assign the same user IDs to two different users
Mac OS X Security: Never assign the same user IDs to two different users
Mac OS X uses user ID numbers -- not alphanumeric usernames -- to define user permissions. As such, it is a bad idea (from a security standpoint) to assign the same user ID to two different users, because they will then be assigned the same directory and file permissions (they will be able to access one another's files and settings) despite having differing usernames and passwords.
To check your current user ID, enter the following command in the Terminal: id and press return. The return should look something like this:
- gid=501(username) groups=501(username), 81(appserveradm), 79(appserverusr), 80(admin)
Since each user in Mac OS X is actually a group, the first gid entry is your user ID.
The interesting part of this behavior comes into play when you consider Mac OS X's new user creation mechanism, which automatically assigns a user ID of 501 to the first created user. So for instance, suppose you allowed a guest to boot from a Mac OS X FireWire startup device connected to your Mac. If said user has a default Mac OS X user account setup, s/he will have immediate access to your (first account, UID=501) data without further ado.
MacFixIt reader James Reid recounts an interesting scenario involving this potential pitfall:
"I installed another copy of Mac OS X on my second internal drive. I used a different user name and password for the 'first user' than I used on my 'first user' on my main internal drive. I confirmed that the uid(501) was the same on both drives for the 'first user' accounts on both drives. I then set permissions on a folder on my third (external drive) to 'no access' for other users from my 'first user' on my main drive. I switched to my second user account on my main drive and made sure the folder was in fact restricted.
"I then booted from my second hard drive and logged in with the 'first user' account on that drive (same uid as my main drive 'first user' but different user name and password) and found that I could freely open the restricted folder on my 3rd hard drive as well as the folders in the"first user" account on my main drive. I did a get info and found that the owner of the folder was now my new user name on the second drive. That said... It is possible for a person who either steals a Mac computer or has unsupervised access to your computer (friends who come over, housekeeper,etc...) to boot your computer from their external OSX drive using the 'Option' key on startup to pick their drive or boot your computer in 'target disk mode' and connecting it to their Mac laptop. Since Mac OS X always starts with the same uid when first setup and then increases incrementally as you add new users, it is possible to breach any user account on the machine by setting up multiple users on their drives.
You can change your user ID through use of the NetInfo application (located in Applications/Utilities), but this will introduce a new host of permissions problems as you will have to propagate the new user ID ownership to all appropriate files. This page has instructions for using the chown command to do so.
Resources