On Nov 7, 2005, at 10:06 AM, Daniel wrote:
On Nov 7, 2005, at 11:52, Bruce Johnson wrote:
On Nov 7, 2005, at 9:39 AM, Daniel wrote:
Interesting. I personally log onto my Tiger (10.4.2) iMac as
root, in order to perform system backups.
I just use RsyncX for backups, or Pseudo if I need to run a GUI
process as root.
Feel free to describe your backup system.
Embarrassingly crude: I have a 200G FW drive I schlep home, plug in
to my systems, and run RsyncX's gui to back up my Users directories,
then I schlep it to work and back up my home directory and website.
I really ought to have two of them that I alternate back and forth so
I've always got an off-site backup. <http://archive.macosxlabs.org/
rsyncx/rsyncx.html>
When I get around to having a high-speed connection from home, I'll
knuckle down and write some cronjobs to do it remotely and
automatically, and leave the big drive at work.
I personally use a script I wrote that uses find & tar to back up
to a Firewire hard disk. I usually run it out of cron, but since
my wife doesn't always shut down her applications overnight, I'm
not convinced the Mail backups, for example, are valid, so I
sometimes log in as root to make those backups. I suppose I could
log everyone out of the console, then ssh in and sudo to root to do
the backup, but that seems a bit silly, and probably unnecessary.
rsync will copy open files, I believe, which avoids that problem. It
also sychronizes backups, making the nightlies a lot less time
consuming.
The problems with running things as root in the GUI is that a heck
of a lot of files that shouldn't be owned by root can be made so.
You end up making a lot of "suid" type holes in your system. (you
also do things like disable programs, printing and other stuff.)
Interesting. I haven't heard any of this before. Would you mind
pointing me to some documentation detailing these types of problems
on a Panther/Tiger system?
None but anecdotal...someone on the list kept having all sorts of
printing and permissions problems; they went away after he stopped
logging in as root and ran repair permissions from disk utility.
Other people on campus have tried to approach OS X as if it were
Linux and run into issues: stuff stops working, stuff doesn't work
like they expected it to, etc.
Also, root exists as a log-innable account, which is just one more
security issue.
Root being able to log into the console is not the same as root
being able to log in via ssh, but you know this. Console access
for root is no more a security issue than is physical access to the
machine. Remote root access, yes, would be a huge problem.
Actually, no. OS X isn't designed for root to have a home folder. I
suspect that can cause issues with security.
OS X ain't a fancy Xwindows kit on top of Unix, and treating it
like Linux or Solaris isn't necessarily a good thing.
Feel free to point me to documentation about the problems of
running as root on an OS X box.
As I said, I've only got anecdotal evidence to say it's a bad thing.
I know the system is designed to not have root log in, and since a
terminal shell is easy enough to convert into a root-owned shell
session, I personally see no reason to enable root.
I've seen enough times where Apple says "don't do this", people do,
and later come to grief to understand that Apple's engineers know
what they're doing with the OS better than I do.
--
Bruce Johnson
This is the sig who says 'Ni!'
--
G-List is sponsored by <http://lowendmac.com/> and...
Small Dog Electronics http://www.smalldog.com | Refurbished Drives |
-- We have Apple Refurbished Monitors in stock! | & CDRWs on Sale! |
Support Low End Mac <http://lowendmac.com/lists/support.html>
G-List list info: <http://lowendmac.com/lists/g-list.shtml>
--> AOL users, remove "mailto:";
Send list messages to: <mailto:[email protected]>
To unsubscribe, email: <mailto:[EMAIL PROTECTED]>
For digest mode, email: <mailto:[EMAIL PROTECTED]>
Subscription questions: <mailto:[EMAIL PROTECTED]>
Archive: <http://www.mail-archive.com/g-list%40mail.maclaunch.com/>
iPod Accessories for Less
at 1-800-iPOD.COM
Fast Delivery, Low Price, Good Deal
www.1800ipod.com
