Ch 2: User Accounts

Front 1

CH2: What are the five types of user accounts in Lion? How are they different?

Back 1

Standard is the default account type; administrative users can make changes to the system; a guest user does not require a password; sharing only users can access only shared files; and the root user has unlimited access.

Front 2

CH2: What are account attributes?

Back 2

Account attributes are the individual pieces of information that are used to define a user account. Examples include full name, account name, user ID, universally unique ID (UUID), group, and home directory.

Front 3

CH2: How can you limit a user account from having full access to all applications?

Back 3

Parental controls can be used to further limit a user account. Examples include enforcing a simple Finder, limiting applications and widgets, setting time limits, and content filtering.

Front 4

CH2: What are some security risks associated with each type of user account?

Back 4

Standard user accounts are very secure, assuming they have good passwords. Administrative users can make changes that may negatively affect the system or other user accounts. A guest user could potentially fill your system drive with unwanted files. Sharing only users are generally very secure as long as you don’t give them too much access to your items. The potential for mayhem with root user access is nearly unlimited.

Front 5

CH2: What default folders make up a user’s home folder? What are some optional folders in a user’s home folder?

Back 5

The default folders in a user’s home folder are Desktop, Documents, Downloads, Library (hidden), Movies, Music, Pictures, and Public. Optional home folder items include Applications and Sites folders.

Front 6

CH2: What types of resource contention issues can occur when fast user switching is enabled?

Back 6

Resource contention occurs when fast user switching is enabled and a user tries to access an item that another user already has open in the background. Document contention occurs when a user attempts to open a document that another user has already opened. Peripheral contention occurs when a user attempts to access a
peripheral that is already in use by another user’s open application. Application con- tention occurs when the second user attempts to access an application that is designed to run only once on a system.

Front 7

CH2: What security risk can occur when fast user switching is enabled?

Back 7

When fast user switching is enabled, all users are allowed to see other users’ locally connected drives.

Front 8

CH2: What does a keychain do?

Back 8

A keychain is an encrypted file that is used to securely save passwords, certificates, or notes. By default, every user has a login keychain that has the same password as his account.

Front 9

CH2: How does Legacy FileVault secure a user’s data?

Back 9

Legacy FileVault stores the user’s home folder in an encrypted disk image. This disk image is accessible only by the Legacy FileVault user.

Front 10

CH2: How does resetting the master password affect existing Legacy FileVault user accounts?

Back 10

If a known master password is reset using the Security & Privacy preferences, Legacy FileVault accounts will not be negatively affected. On the other hand, if a master pass- word is reset because it was lost, Legacy FileVault accounts cannot be reset by the new master password.

Front 11

CH 2: How does resetting a user’s password as an administrative user affect that user’s keychains?

Back 11

If an administrative user resets another user’s account password, this process will not change any keychain passwords. Therefore, the user’s keychains will not automatically open when the user logs in with her new password. The user will have to manually change her keychain passwords using the Keychain Access utility.

Front 12

CH 2: How does the Firmware Password Utility help prevent users from making unauthor- ized password changes?

Back 12

The Firmware Password Utility prevents users from starting up from another system drive. This in turn prevents them from using a Lion Recovery system to reset local passwords without authorization.