2

When I examine the list of users and groups on my machine (OSX 10.9) with id I get:

uid=501(Rax)
gid=20(staff)
groups=20(staff)
       103(Rax),
       12(everyone),
       61(localaccounts),
       80(admin),
       98(_lpadmin),
       33(_appstore),
       100(_lpoperator),
       204(_developer),
       398(com.apple.access_screensharing),
       399(com.apple.access_ssh)

I don't (currently) have any sharing enabled. What are the last two groups and where did they come from? Can I delete them; if so how?


Using sudo dscl . -read /Groups/com.apple.access_ssh I get:

AppleMetaNodeLocation: /Local/Default
Comment:
 SSH Service ACL
GeneratedUID: XXX...
NestedGroups: XXX...
Password: *
PrimaryGroupID: 399
RealName:
 SSH Service ACL
RecordName: com.apple.access_ssh
RecordType: dsRecTypeStandard:Groups

And using sudo dscl . -read /Groups/com.apple.access_screensharing I get:

AppleMetaNodeLocation: /Local/Default
Comment:
 Screensharing Service ACL
GeneratedUID: XXX...
NestedGroups: XXX...
Password: *
PrimaryGroupID: 398
RealName:
 Screensharing Service ACL
RecordName: com.apple.access_screensharing
RecordType: dsRecTypeStandard:Groups

(Though I'm not sure what any of that means.)

  • Why do you want to delete them in the first place? – nohillside Dec 14 '13 at 12:37
  • @patrix: That's what the "what are they" part of the question is about. Perhaps I don't. But I didn't have them before updating to 10.9 and migrating to a new machine, and they sure look like a way to access my machine remotely. – orome Dec 14 '13 at 12:39
  • Groups are used to control access permissions to files/folders, they can not be used to login. – nohillside Dec 14 '13 at 12:48
  • @patrix: So: I shouldn't delete them because there's no reason to might begin to answer the second part of the question. – orome Dec 14 '13 at 12:55
  • This site doesn't work too well with several questions asked at once (in one post). Can you edit your question to either ask "what are these groups for" or "can I safely delete them"? The first would probably result in better answers... – nohillside Dec 14 '13 at 13:00
1

The main admin user on my 10.9 VM is also part of both those groups, so I guess it's normal.

Tests-Mac:~ test$ id
uid=501(test) gid=20(staff) groups=20(staff),12(everyone),61(localaccounts),79(_appserverusr),80(admin),81(_appserveradm),98(_lpadmin),401(com.apple.sharepoint.group.1),33(_appstore),100(_lpoperator),204(_developer),398(com.apple.access_screensharing),399(com.apple.access_ssh)

Membership in the com.apple.access_screensharing group seems to correspond to the user (or a group it's a member of) being included in this list:

When I created a new standard account, it was not a member of the com.apple.access_screensharing group by default, but after I added the account to the list above, it became a member of the group.

Similarly, membership in the com.apple.access_ssh group seems to correspond to the user being included in the list in the Remote Login section.

1

I'll try to answer correctly to the 1st question (and not wait the delay I would need to make a correct answer to 2nd question).

What are the groups:

   398(com.apple.access_screensharing),
   399(com.apple.access_ssh)

for?

These groups are created to separate priviledges.

To be able to manage the access to the screen sharing setting, you just need to be in group 398. You don't need to be root, you don't need to be in the group wheel.

This is a good security policy. This priviledges separation is a real security improvment.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .