Return to Answer

If you can’t install the official patch, then

You don't want to disable root user on High Sierra only.

To secure your Mac, enable root with a long secure password.

Unless you take action, root user is disabled out of the box.

If you want, optionally harden the shell until Apple has an official patch or fix.

Here is a great script to set a random root password and change / set the root shell to /usr/bin/false so that even if the password is guessed, the root shell can't log in:

• https://github.com/rtrouton/rtrouton_scripts/blob/master/rtrouton_scripts/block_root_account_login/block_root_account_login.sh

It basically does three key things:

rootpassword=$(openssl rand -base64 32)
/usr/bin/dscl . -passwd /Users/root "$rootpassword"
/usr/bin/dscl . -create /Users/root UserShell /usr/bin/false

The UserShell create is if the shell is not set, and the full script checks for an existing shell and -changees it instead of -createing it.

How do I protect myself from the root vulnerability in macOS High Sierra?

If you can’t install the official patch or don't want to trust that it worked, then

You don't want to disable root user on High Sierra only.

To secure your Mac, enable root with a long secure password.

We are not changing this at work until the next full point release is out for macOS which would likely be 10.13.2

Unless you take action, root user is disabled out of the box and this is bad if your Mac isn't patched correctly.

If you want, optionally harden the shell until Apple has an official patch or fix.

Here is a great script to set a random root password and change / set the root shell to /usr/bin/false so that even if the password is guessed, the root shell can't log in:

• https://github.com/rtrouton/rtrouton_scripts/blob/master/rtrouton_scripts/block_root_account_login/block_root_account_login.sh

It basically does three key things:

rootpassword=$(openssl rand -base64 32)
/usr/bin/dscl . -passwd /Users/root "$rootpassword"
/usr/bin/dscl . -create /Users/root UserShell /usr/bin/false

The UserShell create is if the shell is not set, and the full script checks for an existing shell and -changees it instead of -createing it.

How do I protect myself from the root vulnerability in macOS High Sierra?

You don't want to disable root user on High Sierra only.

To secure your Mac, enable root with a long secure password.

Unless you take action, root user is disabled out of the box.

If you want, optionally harden the shell until Apple has an official patch or fix.

Here is a great script to set a random root password and change / set the root shell to /usr/bin/false so that even if the password is guessed, the root shell can't log in:

• https://github.com/rtrouton/rtrouton_scripts/blob/master/rtrouton_scripts/block_root_account_login/block_root_account_login.sh

It basically does three key things:

rootpassword=$(openssl rand -base64 32)
/usr/bin/dscl . -passwd /Users/root "$rootpassword"
/usr/bin/dscl . -create /Users/root UserShell /usr/bin/false

The UserShell create is if the shell is not set, and the full script checks for an existing shell and -changees it instead of -createing it.

How do I protect myself from the root vulnerability in macOS High Sierra?

If you can’t install the official patch, then

You don't want to disable root user on High Sierra only.

To secure your Mac, enable root with a long secure password.

Unless you take action, root user is disabled out of the box.

If you want, optionally harden the shell until Apple has an official patch or fix.

Here is a great script to set a random root password and change / set the root shell to /usr/bin/false so that even if the password is guessed, the root shell can't log in:

• https://github.com/rtrouton/rtrouton_scripts/blob/master/rtrouton_scripts/block_root_account_login/block_root_account_login.sh

It basically does three key things:

rootpassword=$(openssl rand -base64 32)
/usr/bin/dscl . -passwd /Users/root "$rootpassword"
/usr/bin/dscl . -create /Users/root UserShell /usr/bin/false

The UserShell create is if the shell is not set, and the full script checks for an existing shell and -changees it instead of -createing it.

How do I protect myself from the root vulnerability in macOS High Sierra?

You don't want to disable root user on High Sierra only.

To secure your Mac, enable root with a long secure password.

Unless you take action, root user is disabled out of the box.

If you want, optionally harden the shell until Apple has an official patch or fix.

Here is a great script to set a random root password and change / set the root shell to /usr/bin/false so that even if the password is guessed, the root shell can't log in:

• https://github.com/rtrouton/rtrouton_scripts/blob/master/rtrouton_scripts/block_root_account_login/block_root_account_login.sh

It basically does three key things:

rootpassword=$(openssl rand -base64 32)
/usr/bin/dscl . -passwd /Users/root "$rootpassword"
/usr/bin/dscl . -create /Users/root UserShell /usr/bin/false

The UserShell create is if the shell is not set, and the full script checks for an existing shell and -changees it instead of -createing it.

How do I disable or remove the root account created as a side effect from this High Sierra security bug?

You don't want to disable root user on High Sierra only.

To secure your Mac, enable root with a long secure password.

Unless you take action, root user is disabled out of the box.

If you want, optionally harden the shell until Apple has an official patch or fix.

Here is a great script to set a random root password and change / set the root shell to /usr/bin/false so that even if the password is guessed, the root shell can't log in:

• https://github.com/rtrouton/rtrouton_scripts/blob/master/rtrouton_scripts/block_root_account_login/block_root_account_login.sh

It basically does three key things:

rootpassword=$(openssl rand -base64 32)
/usr/bin/dscl . -passwd /Users/root "$rootpassword"
/usr/bin/dscl . -create /Users/root UserShell /usr/bin/false

The UserShell create is if the shell is not set, and the full script checks for an existing shell and -changees it instead of -createing it.

How do I protect myself from the root vulnerability in macOS High Sierra?