News for hackers. Stuff that matters.

A comment on macOS High Sierra: Anyone can login as “root” with empty password.

Re:macOS High Sierra: Anyone can login as “root” with empty ... by jonny_eh on Tuesday November 28, 2017 @03:55PM (#15801497)
Looks like changing root’s password blocks the exploit but if you disable the root user, it re-enables the exploit.

Protect yourself by changing root’s password: ⌘ (Command) + Space, Directory Utility, click the lock and enter your password, Edit -> Change Root Password…, then do NOT disable Root User.

Or open a terminal and do:

    sudo passwd
[ Parent | on HN ]
Re:macOS High Sierra: Anyone can login as “root” with empty ... by AdamJacobMuller on Tuesday November 28, 2017 @03:57PM (#15801519)
> click the lock and enter your password

or just enter root with no password

[ Parent | on HN ]
Re:macOS High Sierra: Anyone can login as “root” with empty ... by jonny_eh on Tuesday November 28, 2017 @03:57PM (#15801531)
Ha, ya. That way you know it's still needed!
[ Parent | on HN ]
Re:macOS High Sierra: Anyone can login as “root” with empty ... by davidkclark on Wednesday November 29, 2017 @06:12AM (#15806009)
Disabling the root user again with

  dsenableroot -d
does not re-enable the exploit
[ Parent | on HN ]
Re:macOS High Sierra: Anyone can login as “root” with empty ... by thomastjeffery on Tuesday November 28, 2017 @04:43PM (#15802088) 

    sudo passwd
Does that change the password for the current user without authentication, or does it change the password for root without authentication?

I think it would be best to recommend an unambiguous

    sudo passwd root
[ Parent | on HN ]
Re:macOS High Sierra: Anyone can login as “root” with empty ... by LeoPanthera on Tuesday November 28, 2017 @05:04PM (#15802287)
"sudo foo" with no other arguments runs "foo" as root. "passwd" with no other arguments changes the password of the user it is running as.

"sudo passwd" unambiguously changes the password of root.

[ Parent | on HN ]