Macos high sierra root how to#

There has been a bit of a debate after Tuesday's disclosure. While the original command with echo will work for some, others may need the code below: cat /dev/urandom | env LC_CTYPE=C tr -dc a-zA-Z0-9 | head -c 60 | xargs -I rootpw sudo dscl. Randomize them, since you won't actually need the account. Rob Fuller, also known as Mubix, has some sound advice for those who are enabling and setting a root password in order to deal with today's problems. We'll keep updating this story as new information emerges.

Macos high sierra root how to#

We have internally confirmed that it adversely affects the Screen Sharing service.'Īpple says they're working on a software update to address the issue, and is directing users to a support document explaining how to enable root and set a secure password. Given the level of access the root account has, it has many (and wide-ranging) potential security impacts, including remote access through various services. God-mode) user - enabling passwordless root access to your system. 'By testing this vulnerability on your own system, you remove existing safeguards around the root (i.e. The danger here is that, by creating such an account, it will affect remotely accessible services such as Remote Desktop,' explained Bugcrowd's Keith Hoodlet, Trust and Security Engineer. 'By testing this vulnerability on your own computer, you'll end-up creating (or modifying) a persistent root user account on your system. Those testing (exploiting) the problem locally will open themselves up to remote attack. This was confirmed shortly after the public started looking at the bug by various researchers.Īnother important note comes from researchers at Bugcrowd. High Sierra users need to address this issue urgently, as the root password bug is exploitable remotely, including VNC and Apple Remote Desktop. Internal testing here at IDG couldn't reproduce the issue on anything other than High Sierra. At this point, it's not clear if High Sierra is the only OS affected.