Section 12.8. The Root Account

12.8. The Root Account

An administrator's account isn't exactly a skeleton key that gives unfettered access to every corner of the Mac. Even an administrator isn't allowed to remove files from the System folder, or other files whose removal could hobble the machine.

It turns out that Normal and Administrator aren't the only kinds of accounts. There's one account that wields ultimate power, one person who can do anything to any file anywhere . This person is called the superuser .

Unix fans speak of the superuser accountalso called the root accountin hushed tones, because it offers absolutely unrestricted power. The root account holder can move, delete, rename, or otherwise mangle any file on the machine, no matter what folder it's in. One wrong moveor one Internet hacker who manages to seize the root accountand you've got yourself a $2,500 doorstop. That's why Mac OS X's root account is completely hidden and, in fact, deactivated from the start.

Still, if you know what you're doing, and you see no alternative, you might be glad the root account is available.

You turn on the root account like this:

1. In your Applications Utilities folder, open the NetInfo Manager program. Click the tiny padlock in the lower-left corner of its screen .

   A dialog box asks you for an administrator's name and password. After all, you wouldn't want ordinary underlings fooling around with the superuser account.

2. Type your name and password, and then click OK. Choose Security Enable Root User .

   If this is the first time you've performed this particular surgery, you'll be told, "The root password is currently blank." You're asked to make up a "non-trivial" (meaning virtually impossible for anyone to guess) password for the newly created root account.

3. Click OK and then type the password in both of the bottom Password boxes. Click OK two more times .

   The second dialog box simply tells you that if you intend to make any more changes in NetInfo Manager, you'll have to sign in as an administrator again . But your work here is done.

4. Quit NetInfo Manager .

   You've just brought the dormant root account to life.

5. Log out. Log back in again as root .

   That is, when the login screen appears, click Other User (a choice that magically appears once you've turned on the root account). In the first text box, type root . In the second, type the password you made up in step 4. Click Log In.

That's ityou arrive at the desktop, where no matter what you do, no error messages regarding access privileges or ownership will interrupt the proceedings . In the words of every movie hero's sidekick: Be careful out there.

When you're finished going about your business as a root user, immediately log out again. It's important to rule out the possibility that some clueless or malicious person might wander up to the Mac while you're still logged in as the superuser.

In fact, if you don't anticipate needing your superuser powers again soon, consider turning off the root account altogether. (Just repeat steps 1 and 2 on the preceding page. But in step 2, choose Security Disable Root User.)