Mac® Security Bible

3.3. Types of Accounts

Earlier in this chapter, I described what an account is, and in the last section, I explained how the user and group names associated with accounts apply to files and folders. There's yet another piece of the puzzle though: the variety of account types as they appear in Mac OS X.

Depending on how you want to slice it, you could think of Mac OS X as having two, three, or as many as eight or more different account types. However you want to categorize them, account types are important because they indicate what sorts of actions are required, permitted, or prohibited for that sort of user (including but not limited to POSIX permissions).

In a moment, I describe all the different account types, but to help you get your bearings, here's the overall hierarchy, broken down into the smallest reasonable chunks. There are two basic account types for users: administrator and standard. Managed, guest, and sharing only accounts are technically sub-varieties of standard accounts — making a total of five types so far. Two other account types don't show up at all in Mac OS X's graphical interface: root (an all-powerful account that you can optionally turn on for command-line access only) and system accounts, which various parts of Mac OS X use behind the scenes to divvy up tasks and permissions. The final account type is a group, which isn't really an account itself but rather a list of related accounts. I list it here because it sometimes appears in lists of account types. ...