Super and admin user in OS X

sudounix

Superuser account is disabled by default in OS X (Mavericks). But if you run sudo -l you will come to know that the admin user can execute all superuser commands. Then what is the point of disabling superuser? What are the actual differences between super user and admin user?

Best Answer

But if you run sudo -l you will come to know that the admin user can execute all superuser commands. Then what is the point of disabling superuser?

Any user that can escalate their privilidges to root can execute all superuser commands, and any member of the admin group on OS X can escalate to root privilidges using sudo. Generally, without escalating to root privileges, a user cannot execute commands reserved to root, so you may be reading more into sudo -l than is there.

There is only one root account, one superuser. The point of disabling it is so that no one can gain access to the actual root account, they can only gain root privilidges by using sudo. Sudo offers some benefits: all attempts to authenticate with sudo are logged, and all commands run using sudo are logged; sudo can be restricted with user permissions using the /private/etc/sudoers file; sudo can be run using an admin users' password, so they don't need to know the root password; sudo will also eventually time out, and require authentication again.

I found a very nice article here on the benefits of sudo and how it compares to using su or logging in as root. The article concerns Ubuntu, but the basic information remains the same for OS X and any BSD or UNIX flavor.