File Sharing Security and User Accounts in Mac OS 9

Mac OS 9 bridged the gap between the classic single-user operating system and modern multi-user environments by pairing its traditional AppleShare networking with an expanded Multiple Users architecture. This article examines how Mac OS 9 reconciled local user account configurations with network File Sharing permissions, detailing how user authentication, folder-level access privileges, and account restrictions interacted across local and remote sessions.

The Foundation: File Sharing and the Users & Groups Model

In Mac OS 9, network file access relied on the AppleTalk Filing Protocol (AFP), configured primarily through the File Sharing control panel. Security identity centered on the "Users & Groups" database. Unlike modern POSIX-based Unix permissions, access was managed through three explicit identity categories:

  • Owner: The primary administrative identity assigned to the Mac, possessing unrestricted access to all shared resources.
  • Registered Users: Named accounts with specific passwords that could be assigned to one or more custom Groups.
  • Guest: An anonymous identity that could be globally enabled or disabled to allow unauthenticated public access.

When a remote user connected over AppleTalk or TCP/IP (via port 548), the File Sharing server authenticated the credentials directly against the local Users & Groups directory.

Integration with the Multiple Users Control Panel

Mac OS 9 expanded local access control by introducing the Multiple Users control panel, which categorized local users into Normal, Limited, and Panels environments.

The security settings between File Sharing and Multiple Users interacted directly:

  1. Shared Identity Database: Creating a local user account in the Multiple Users control panel simultaneously registered that user within the File Sharing environment. Administrators could manage network sharing privileges for that specific account, such as allowing the user to connect remotely or change their own password.
  2. Access Privileges on Personal Folders: When Multiple Users was active, Mac OS 9 automatically generated private user folders (typically inside a "Users" directory). The system assigned ownership of that specific folder to the corresponding user account, effectively locking other local Limited/Panels users and remote non-owners out of that directory.
  3. Restricted Network Logins: If an account was configured as a "Limited" or "Panels" user locally, an administrator could disable their ability to access the machine remotely via File Sharing, ensuring that restricted accounts could not bypass interface locks by mounting the drive over a local network.

Folder-Level Access Privileges

File Sharing security was enforced at the folder level rather than on individual files. Users with ownership rights configured folder permissions through the Finder’s "Get Info" window under the "Sharing" panel. Permissions were governed by three distinct settings applied to the Owner, a specified User/Group, and Everyone:

  • See Folders: Allowed the user to view the directory hierarchy within the shared volume or folder.
  • See Files: Allowed the user to view and read files stored inside the folder.
  • Make Changes: Granted the ability to write new files, edit existing contents, and create new directories.

An additional safety feature, "Can't be moved, renamed or deleted," could be toggled to prevent accidental or malicious destruction of key folders by authorized users.

Security Limitations in the Classic Architecture

Because Mac OS 9 lacked a preemptive, multi-user kernel with memory protection, File Sharing permissions were enforced primarily at the AppleShare software layer rather than at the core filesystem level.

While remote authenticated users were strictly constrained by the permissions defined in the Sharing window, physical access to the local machine could circumvent these boundaries. Booting from an external drive, disabling extensions, or utilizing an unrestricted administrative account would instantly bypass the file access boundaries defined for individual user accounts.