Henry B. Hotz wrote: > The practical experience here, so far, is that the "MacOS way" is *less* > secure. Since we have a high proportion of developers most machines are > configured with admin rights for the primary user. That means that > stealing the user's password is equivalent to stealing the root password > for the machine.
But on Solaris you would still need the root password as well. > The direction we're headed is to have separate normal and admin accounts > with nothing automatically granting any of the latter rights to the > former. On a single-user machine the admin account may as well be > "root". A server with an admin group is a different animal, of course. Which is actually what a role is with the restriction that roles can't login directly - so you have a proper audit trail - and you restrict which users can become the admins. -- Darren J Moffat
