Password - login Issue - Please help!!

[ruchiccio]

Ok, I'm running OSX 10.6.4 on my iMac. I am the administrator of this computer and I set up a password for my account. I also made it so that when you want to exit the screensaver, you also need to input your password.

Someone in my office hinted to me that she can "go in" to my computer even though the screensaver is on and she does NOT know my password. At first I didn't believe her but then I noticed something really odd. I come to my computer after it went into screensaver mode, I input my password and it does NOT WORK. I am sure about the password. Left with no other choice, I reboot my computer, and when prompted to login with password, it works FINE! How can a password not work to exit the screensaver, but can work normally when turning on the computer?

Also, please tell me if there is a way to access my computer somehow even though the password request window is open (what my co-worker claims she can do). I do know that you can use options such as the music controls on the keyboard, even though the password hasn't yet been entered. But I have found that my computer is not as I left it (programs I left running were now closed). It's driving me crazy because who know what else she can do on my computer!!

 

[angelwatt]

Maybe she created her own account on your machine and just made you think it was still logged in as you. It's pretty easy to create a new account without knowing the existing account.

Also Snow Leopard has an option where it will wait for a while after the screen saver starts that it will not ask for a password when awakened.

System Preferences > Security > General : Top check box and drop menu

 

[ruchiccio]

Thanks for the ideas, but no - there is no other account installed on my computer. Since I'm the admin I can see all the accounts and there is only one - me!

I know about that feature too, and I made sure the password is requested immediately after the screen saver turns on.

 

[angelwatt]

Thanks for the ideas, but no - there is no other account installed on my computer. Since I'm the admin I can see all the accounts and there is only one - me!

She could have used single user mode, which you wouldn't see.

Here was a similar discussion in the forums.

You can also check the file at /var/log/secure.log to see all logins on the machine including from screen saver.

 

[ruchiccio]

Changing password without being logged in.

Someone keeps coming over to my iMac (OSX 10.6) and changing my password! The thing is, I have a screensaver that's passworded so in order to exit screensaver mode, you have to log in. She somehow manages to change my password to something else (even though I'm the admin) and easily exit screen saver, and has access to my computer! She does not know my password, obviously. All she does is change MY password and presto! This person doesn't even own a mac and is NOT tech-savvy, so the solution has to be somewhat simple, but I can't figure it out!!!! If I go into Console, I can copy out the scripts that were running at the time (I know when she was doing it on my computer), so would that help?

 

[UpQuark]

Someone keeps coming over to my iMac (OSX 10.6) and changing my password! The thing is, I have a screensaver that's passworded so in order to exit screensaver mode, you have to log in. She somehow manages to change my password to something else (even though I'm the admin) and easily exit screen saver, and has access to my computer! She does not know my password, obviously. All she does is change MY password and presto! This person doesn't even own a mac and is NOT tech-savvy, so the solution has to be somewhat simple, but I can't figure it out!!!! If I go into Console, I can copy out the scripts that were running at the time (I know when she was doing it on my computer), so would that help?

Lots of questions.. does she have a boot disk? She can boot from your DVD drive adn change your password that way too. (You have to set up a firmware password to prevent that)

I am not sure how to bypass the screensaver password - but do you have it on a timer? Make the timer 1 min and set a hot corner - then use that hot corner religiously.

Do you change your password back to the same one as before?

How do you change your password back? Does she tell you the new password?

 

[FourCandles]

Are you sure that this person is not doing this by logging in on an ssh session over the network and using the command line?

 

[ruchiccio]

UpQuark, no, she does not have any disk. I only have one and it's kept off-site.

I have the password on a timer, it goes on after 5 minutes of inactivity and the login box pops up immediately upon launching of the screensaver. I didn't think about the hot corner idea, thanks!

I have kept changing my password, each time after she changed it herself. Of course, she would tell me her new password each time she changed it just so I can go in!

FourCandles, what is a SSH session and command line? My computer and hers are on the same network, but as I said, she is NOT tech-savvy so if I don't know what these terms mean, she definitely doesn't

 

[FourCandles]

SSH = Secure Shell.

If you have Remote Login enabled in the Sharing Section of System Preferences (check this!), then one can login in via Terminal on another Mac (or the equivalent on another OS) as an admin, by typing

ssh adminusername@computername.local

or

ssh adminusername@<IP address>

and entering the admin password.

Once in to the Darwin session, it's then a matter of typing a simple command to change any user's password. You don't have to know the existing password to do this.

 

[ruchiccio]

OK, I'll give it a check when I get home. But as far as I know, I don't have this option enabled (I don't recall every doing, but then again, it may be set by default).

Thanks

 

[Darth.Titan]

SSH = Secure Shell.

If you have Remote Login enabled in the Sharing Section of System Preferences (check this!), then one can login in via Terminal on another Mac (or the equivalent on another OS) as an admin, by typing

ssh adminusername@computername.local

or

ssh adminusername@<IP address>

and entering the admin password.

Once in to the Darwin session, it's then a matter of typing a simple command to change any user's password. You don't have to know the existing password to do this.

But they would not be able to do this without his password to login with. If they know that, then why login via SSH at all to change his password? If they knew the password to begin with they could just type that at the screensaver prompt and skip the whole remote login step..
I seem to be missing something here...

1. You're using a screensaver that requires a login to exit.
2. The person in question is changing your password WITHOUT being logged in.
3. Then this person is logging in past the screensaver using the new password.
4. This person is not tech savvy, so SSH and boot disks are out of the question.

This just doesn't make sense. This shouldn't be possible. Either the person in question is FAR more tech savvy than you think, or we're all misunderstanding the issue.

Are you using an OS X screensaver from System Preferences, or is it perhaps a third-party screensaver?
Is your account the only account on the computer? Are there other admin accounts besides yours?
If this person is amenable to giving you the changed password so readily, see if they would be willing to show you exactly how they're doing what they're doing. I seem to be missing something.

Unless they are familiar with the Unix command line, you have the root user enabled, they know your root password, and they are accessing via SSH it should be impossible to change your password from a screensaver prompt.

 

[ruchiccio]

I know it sounds crazy, but numbers 1-4 in your list are true!
1. yes, the screensaver can only be exited by logging in.
2. right. she does not know my password. just to make sure, i changed my password to something totally random that I thought of that second, and had her do her magic. within 2 minutes (she made me leave the room, of course) she had changed the password. but since she doesn't know my original password, she couldn't undo her change in the system preferences area.
3. yep, with her new changed password, she can somehow get right back to my desktop. this has happened even when the computer was asleep and she had to log in.
4. exactly.

i'm using a regular screensaver that came with OS X. There is only 1 admin account on my computer, and that's me. I have disabled the ability to log in as guest.

No that's the thing! She wants to have one up on me so she will not tell me how she does it. I have tried spying but it didn't work. The whole thing took her like 2 minutes to do.

And the worst part (I don't mind THAT much that she's using my computer) is that she keeps mocking me with "I CAN'T believe you didn't figure it out!" and it's driving me crazy.

 

[yellow]

We only need 1 thread on this issue, thanks.

• How many user accounts are on the Mac?
• Is root enabled?
• Does she have a local account?
• Is she part of /etc/sudoers?
• What GIDs is she a member of?

 

[ruchiccio]

We only need 1 thread on this issue, thanks.

I'm not sure I understand what you're referring to? I haven't posted twice about this.

 

[advres]

So she is bragging about ***** with you at work by messing with YOUR WORK computer? How about you do the smart thing and tell her to keep her grubby paws off your machine or you'll go to HR. If I EVER came back to my desk and saw someone on my computer I probably would get fired or arrested, and probably both because the first thing I could grab would be rapped off their skulls. It's like going through someones mail, 100% unacceptable even if you have 100% nothing to hide. You just don't do it.

Luckily I work from home so I don't have that problem

 

[yellow]

I'm not sure I understand what you're referring to? I haven't posted twice about this.

You had 2 separate threads on this topic. One started on 8/13 and one starts on 8/17.

They have been merged into this single thread.


These questions should be answered..

• How many user accounts are on the Mac?
• Is root enabled?
• Does she have a local account?
• Is she part of /etc/sudoers?
• What GIDs is she a member of?

 

[ruchiccio]

So she is bragging about ***** with you at work by messing with YOUR WORK computer? How about you do the smart thing and tell her to keep her grubby paws off your machine or you'll go to HR. If I EVER came back to my desk and saw someone on my computer I probably would get fired or arrested, and probably both because the first thing I could grab would be rapped off their skulls. It's like going through someones mail, 100% unacceptable even if you have 100% nothing to hide. You just don't do it.

Would LOVE to, except she's my sister and this is taking place on my home computer hehehe!

She is a pretty ethical person and does this only because she needed to use photoshop and her computer doesn't have it. She doesn't read through my stuff or whatever. I can see her actions by simply looking at Console. But I have told her 1000 times to install PS on her own computer (she gets it free from school). But no... she insists on using my mac, well who wouldn't?!

You had 2 separate threads on this topic. One started on 8/13 and one starts on 8/17.

They have been merged into this single thread.


These questions should be answered..

One account only, admin, and that's me.
I have no idea what enabled root means.
She has an account on our network but not on my computer.
Sorry I have no clue what /etc/sudoers are or what GIDs are either!

 

[advres]

Would LOVE to, except she's my sister and this is taking place on my home computer hehehe!

Good, so now you don't have to worry about getting fired when you hit her!

 

[yellow]

Run /System/Library/CoreServices/Directory Utility.app

Edit pull-down menu.. does it say "Disable Root User"? If so, then she's using root to mess with your head.

 

[ruchiccio]

Run /System/Library/CoreServices/Directory Utility.app

Edit pull-down menu.. does it say "Disable Root User"? If so, then she's using root to mess with your head.

I'll check later when I'm home, and report back here. Thanks.

 

[ruchiccio]

Run /System/Library/CoreServices/Directory Utility.app

Edit pull-down menu.. does it say "Disable Root User"? If so, then she's using root to mess with your head.

No, the menu gives me the option to enable it.

 

[foeniox]

Need to narrow down the options here.

1) Turn off the wifi, disable the ethernet in system preferences - make sure the computer is completely disconnected from the network and then ask her to unlock it again.

- This should rule out any network based bypass such as SSH. In reply to Darth.Titan it is possible to use SSH without the password by having a key in your .ssh/authorized_keys.

Though since you say she's not tech savvy i highly doubt this is whats happening.

You say she's able to unlock the computer and change the password. Does she have to restart the computer to do so?

2) Turn on the sound, put it on full volume. If she restarts you should still be able to hear it when you're in the other room. Also perhaps open a new TextEdit file and type some text into it - don't save the file, and if she restarts you'll know.

I think i know how she's doing it, it's not a complex procedure, needs no disks, and doesn't require you to be tech savvy to do so. But i need to have the above two points cleared before i can be sure.

PS. don't use the hot corner to enable the password lock, it's such a pain in the ass if your mouse slips. Open Keychain Access (/Applications/Utilities/) > Open its preferences (CMD ,) > select "Show Status in Menu Bar". You can now lock the screen by clicking the lock icon in your menubar.

 

[ruchiccio]

Brilliant ideas! However, she does not need to restart my computer because the programs are always open the way I left them in the morning. Meaning, she does it all without restarting. One of the times she was demonstrating her feat, the computer "froze", she claimed - but really it was because she tried entering something wrong 3 times so it went to sleep. So she restarted it by pressing the power button and was able to change the password by the first log-in screen. Thus, she can do her thing without restarting, but it also works if she must restart.

But I"ll try out with the wifi thing, I guess.

PLEASE tell me what you were thinking of! Thanks!!!

 

[chown33]

2) Turn on the sound, put it on full volume. If she restarts you should still be able to hear it when you're in the other room. Also perhaps open a new TextEdit file and type some text into it - don't save the file, and if she restarts you'll know.

Another way to know if the computer was restarted is to use the 'uptime' command in Terminal. Simply launch Terminal.app and type or paste in this command line:

uptime

It will tell you how long since the computer was last booted. I don't know of an easy way to forge this, either. Sound can be attenuated and unsaved files can be remade.

Here's another command line that tells you the actual boot time and date:

sysctl kern.boottime

 

[LPZ]

PS. don't use the hot corner to enable the password lock, it's such a pain in the ass if your mouse slips. Open Keychain Access (/Applications/Utilities/) > Open its preferences (CMD ,) > select "Show Status in Menu Bar". You can now lock the screen by clicking the lock icon in your menubar.

Nice tip. Thanks.