3

It's been suggested that, since the root account now appears in the accounts database on macOS 10.13.1+ by "default" (by accident it seems), it might be a good security measure to disable shell access for that account.

Will doing so disable the ability to boot into Single User Mode?

  • Single user mode uses /private/etc/passwd for login authentication, not Open Directory. – fd0 Dec 2 '17 at 14:02
  • @fd0: So setting sudo /usr/bin/dscl . -create /Users/root UserShell /usr/bin/false will leave Single User Mode untouched? – orome Dec 2 '17 at 14:04
  • Please don't cross-post – nohillside Dec 2 '17 at 14:29
  • @patrix: This is a distinct question. Not a cross post. And wasn't there a comment here that focused the question (and would have avoided the unhelpful answer) – orome Dec 2 '17 at 14:31
  • 1
    As @fd0 and my answer say: No, setting the shell to /usr/bin/false with dscl has no impact on single user mode. The answers you got to the unix.stackexchange.com version of the question may be valid for Unix/Linux in general, but not for macOS. – nohillside Dec 2 '17 at 14:57
4

As @fd0 already commented, "single user mode uses /private/etc/passwd for login authentication, not Open Directory":

pse@Mithos:~$ grep ^root: /etc/passwd 
root:*:0:0:System Administrator:/var/root:/bin/sh

but

pse@Mithos:~$ sudo dscl . -read /Users/root UserShell
UserShell: /usr/bin/false

So single user mode will happily read the content of /etc/passwd and start a root shell with /bin/sh even if you set the shell to false with dscl.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .