My user account is a standard account on my Mac. What must I enter into Terminal using sudo, to make myself the administrator?
-
1Is this about permanently changing your user account, or about running a terminal session with the rights of an admin (or root) user for which you know the logon info?– rackandbonemanDec 16, 2015 at 11:19
Add a comment
|
3 Answers
If the actual user < user_name > has a standard account, you would have to enter
sudo dscl . -append /Groups/admin GroupMembership <user_name>
to make < user_name > an admin.
Only a restricted number of users are sudoers (i.e. accounts which are allowed to run su or sudo with root privileges successfully) though. The standard sudoers file (/etc/sudoers) in OS X looks like this:
...
# User privilege specification
root ALL=(ALL) ALL
%admin ALL=(ALL) ALL
# Uncomment to allow people in group wheel to run all commands
# %wheel ALL=(ALL) ALL
...
So only root and members of the admin group are allowed to run sudo by default. The above command run by < user_name > will fail consequently, because < user_name > isn't in the list.
To enable sudoing for < user_name >, you would have to add < user_name > to the list (below # User privilege specification) or uncomment the %wheel line with sudo visudo which has to be run by sudoers again (that's the Catch22 mentioned by Tetsujin).
answered Dec 15, 2015 at 17:35
-
1
-
1I don't recall: didn't the latest OSX rev. include some sort of "not-really-sudo" that lacks full standard Unix su rights? Dec 16, 2015 at 0:51
-
3
That's a bit of a Catch22…
You need to already be an administrator to be on the sudoers list [with very few manually-changed exceptions]
Essentially, you cannot promote yourself.
That's the entire point of sudo & being an administrator, to be able to assign non-admins limited abilities.
answered Dec 15, 2015 at 16:21
If you have access to an administrator account, you can become that account temporarily with:
su - <admin_username>
From there you can perform administrative actions via sudo.
If you do not have access to an administrator account, then there is no "sanctioned" way of getting admin access (since that's the whole point to having separate admin roles), but there are plenty of less-than-legitimate ways of attaining it, such as privilege escalation exploits or booting into single-user mode. (These will be left as an exercise to the reader.)
