Geek Posted September 21, 2011 Posted September 21, 2011 <div class="KonaBody"><p><img src="http://osxdaily.com/wp-content/uploads/2011/09/lock-dscl-utility-os-x-lion.jpg" alt="lock the dscl utility in os x lion" title="lock-dscl-utility-os-x-lion" width="150" height="216" class="alignright size-full wp-image-21459" /> We recently wrote about the dscl utility and how it allows a Mac OS X Lion user to <a href="http://osxdaily.com/2011/09/19/change-password-mac-os-x-10-7-lion-without-knowing-current-password/">change a password without knowing the existing password</a>. The lack of required admin authentication has since been widely reported as a bug, and a small Security Update will likely be issued by Apple sometime in the near future. Nonetheless, if you’re paranoid about someone getting ahold of your Mac and changing the user password without authorization, you can <strong>manually change the permissions of the dscl utility</strong> yourself, forcing it to require administrative privileges in order to be run.</p> <ul> <li>Launch Terminal (located at /Applications/Utilities/)</li> <li>Type the following command and hit return:</li> <p><code>sudo chmod 100 /usr/bin/dscl</code></p> <li>You will be asked for the current administrative password to confirm the permissions change, enter it and hit return</li> </ul> <p>This is a simple permissions fix that likely mimics what an official security update will do. Using sudo chmod 100 states that only the owner (root) is able to execute the dscl command, which effectively prevents other non-admin users from accessing the directory services utility without using the sudo command, and thus the administrator password.</p> <p>There may be some unintended consequences of changing those permissions, but it’s unlikely to effect most users. If you do encounter some problems you can always change the permissions back, which look to be set as 755 by default. </p> <p>A big thanks to <a href="http://osxdaily.com/2011/09/19/change-password-mac-os-x-10-7-lion-without-knowing-current-password/#comment-240623">“Tjb” who left this tip in the comments</a>! </p> <p><strong>Update:</strong> Jim T left the following recommendation in the comments, suggesting another chmod command to change the permissions:</p> <blockquote><p>Instead, do this:</p> <p>sudo chmod go-x /usr/bin/dscl</p> <p>That will -only- remove the execute permission on group and other, leaving the other permissions (read & write, and root’s full permissions) completely as was before the change. To reverse, do:</p> <p>sudo chmod go+x /usr/bin/dscl</p> <p>Only touch the stuff you need to touch!</p></blockquote> <p>His reasoning is that chmod 100 is too restrictive in that it changes the command to execute only, where as before the root user could read, write, and execute. </p> </div> <p><a href="http://feedads.g.doubleclick.net/~a/SnO8uFBqF5kCLwIxg0RXmfZO5jg/0/da"><img src="http://feedads.g.doubleclick.net/~a/SnO8uFBqF5kCLwIxg0RXmfZO5jg/0/di" border="0" ismap="true"></img></a><br/> <a href="http://feedads.g.doubleclick.net/~a/SnO8uFBqF5kCLwIxg0RXmfZO5jg/1/da"><img src="http://feedads.g.doubleclick.net/~a/SnO8uFBqF5kCLwIxg0RXmfZO5jg/1/di" border="0" ismap="true"></img></a></p><div class="feedflare"> <a href="http://feeds.feedburner.com/~ff/osxdaily?a=GKniJs8qeFQ:VEiySK9CMl8:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/osxdaily?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/osxdaily?a=GKniJs8qeFQ:VEiySK9CMl8:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/osxdaily?i=GKniJs8qeFQ:VEiySK9CMl8:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/osxdaily?a=GKniJs8qeFQ:VEiySK9CMl8:D7DqB2pKExk"><img src="http://feeds.feedburner.com/~ff/osxdaily?i=GKniJs8qeFQ:VEiySK9CMl8:D7DqB2pKExk" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/osxdaily?a=GKniJs8qeFQ:VEiySK9CMl8:7Q72WNTAKBA"><img src="http://feeds.feedburner.com/~ff/osxdaily?d=7Q72WNTAKBA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/osxdaily?a=GKniJs8qeFQ:VEiySK9CMl8:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/osxdaily?d=qj6IDK7rITs" border="0"></img></a> </div><img src="http://feeds.feedburner.com/~r/osxdaily/~4/GKniJs8qeFQ" height="1" width="1"/> View the full article
Recommended Posts