Hi, I have been using Mac OS X for quite a while now, and I have just found something that concerns me a little.

As you probably know Mac OS X is based on BSD and by default does not have any services running (though it is not hard to turn these on) thefore is reasonably secure out of the box.

Now as you may be aware one of the major differnces in the way Mac OS X deals with some information, for example the password file in /etc is there but not used. Such things are taken care of via netinfo. Anyway to get to the core of the matter, I was looking through the file structure, looking at some of the config files, and such, when I happened to look in /var/backups in var/backups there was one file called: "local.nidump"

This is a file which contains from what I can tell a fair part if not all of the information stored in the netinfo database, including users and passwords.

Here is the information for a user I created for this purpose:

"_shadow_passwd" = ( "" );
"_writers_passwd" = ( "test" );
"hint" = ( "" );
"uid" = ( "502" );
"_writers_hint" = ( "test" );
"gid" = ( "20" );
"realname" = ( "test" );
"name" = ( "test" );
"passwd" = ( "Fnh1eLU0U6o12" );
"shell" = ( "/bin/tcsh" );
"home" = ( "/Users/test" );
"sharedDir" = ( "Public" );

The issue is that my user "test" was created without the option to administer the system (by default root isn't enabled in Mac OS X.) This user though could access and copy and read this file, via a shell and also via ftp (please note again things like ssh and ftp are not started by default they have to be enabled in sharing under system preferences.

As I see it and please correct me if I am wrong here, it is a bad idea to have such a file acessable to any user of the system, especially since the average mac user most likley doesn't understand things as permisions and the dangers of having things like ssh, telnet, and ftp open and giving people access to such things, also when a user does enable these services there are no warnings that mention the security issues whith said services.

Anyway, I hope I am not reading too much into this.

Regards,

Benjamin Gardiner