3

Superuser account is disabled by default in OS X (Mavericks). But if you run sudo -l you will come to know that the admin user can execute all superuser commands. Then what is the point of disabling superuser? What are the actual differences between super user and admin user?

5

But if you run sudo -l you will come to know that the admin user can execute all superuser commands. Then what is the point of disabling superuser?

Any user that can escalate their privilidges to root can execute all superuser commands, and any member of the admin group on OS X can escalate to root privilidges using sudo. Generally, without escalating to root privileges, a user cannot execute commands reserved to root, so you may be reading more into sudo -l than is there.

There is only one root account, one superuser. The point of disabling it is so that no one can gain access to the actual root account, they can only gain root privilidges by using sudo. Sudo offers some benefits: all attempts to authenticate with sudo are logged, and all commands run using sudo are logged; sudo can be restricted with user permissions using the /private/etc/sudoers file; sudo can be run using an admin users' password, so they don't need to know the root password; sudo will also eventually time out, and require authentication again.

I found a very nice article here on the benefits of sudo and how it compares to using su or logging in as root. The article concerns Ubuntu, but the basic information remains the same for OS X and any BSD or UNIX flavor.

  • just up voted this! Good answer. as for the other one, however...i call it like i see it friend. – njboot May 31 '14 at 5:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .