RHEL: Force system to prompt for password in Single User mode

RHEL: Force system to prompt for password in Single User mode

# Tested on RHEL 5, 6 & 7

# Due to security reasons, one may want to force system to prompt for root password even
# in Single User mode

# By default, system doesn't ask for password and we are given root shell directly. Indeed,
# usually Single User mode is used to reset root password in case we forgot it.

# Note that after modifying configuration, in case of forgotten root password, you'll have
# to boot the system in rescue mode to revert configuration in order to be able to change
# root password in Single User mode.



# RHEL 5
# ------------------------------------------------------------------------------------------

# To force users to enter password in Single User mode, add following line to /etc/inittab:

~:S:respawn:/sbin/sulogin

# The changes to this file takes effect after a system reboot

# To make init re-read the /etc/inittab without rebooting the system, type the command

/sbin/init q



# RHEL 6
# ------------------------------------------------------------------------------------------

# Edit /etc/inittab and add "su:S:wait:/sbin/sulogin" before 'initdefault' line:

vi /etc/inittab
   [...]
   su:S:wait:/sbin/sulogin
   id:3:initdefault:

# Edit /etc/sysconfig/init and replace "SINGLE=/sbin/sushell"  with "SINGLE=/sbin/sulogin":

vi /etc/sysconfig/init
   [...]
   # Set to '/sbin/sulogin' to prompt for password on single-user mode
   # Set to '/sbin/sushell' otherwise
   SINGLE=/sbin/sulogin



# RHEL 7
# ------------------------------------------------------------------------------------------

# By default, Single User mode is password protected by the root password on RHEL 7:

cat /usr/lib/systemd/system/rescue.service
   [...]

   [Service]
   Environment=HOME=/root
   WorkingDirectory=/root
   ExecStartPre=-/bin/plymouth quit
   ExecStartPre=-/bin/echo -e 'Welcome to emergency mode! After logging in, type [...]
   ExecStart=-/bin/sh -c "/usr/sbin/sulogin; /usr/bin/systemctl --fail --no-block default" <---
   Type=idle
   StandardInput=tty-force
   StandardOutput=inherit
   StandardError=inherit
   KillMode=process
   IgnoreSIGPIPE=no
   SendSIGHUP=yes
0 (0)
Article Rating (No Votes)
Rate this article
Attachments
There are no attachments for this article.
Comments
There are no comments for this article. Be the first to post a comment.
Full Name
Email Address
Security Code Security Code
Related Articles RSS Feed
Linux Proxy Server Settings – Set Proxy For Command Line
Viewed 3802 times since Mon, Feb 18, 2019
Open SSL HowTo: Decode SSL Certificate
Viewed 6231 times since Mon, Feb 18, 2019
stunnel basics and pki standards
Viewed 9590 times since Fri, Sep 28, 2018
Red Hat 8 How to Set Up Automatic Updates for CentOS 8
Viewed 3949 times since Fri, Sep 25, 2020
LVM: Recovering Physical Volume Metadata
Viewed 13272 times since Sat, Jun 2, 2018
Using stunnel and TinyProxy to obfuscate HTTP traffic
Viewed 7126 times since Fri, Sep 28, 2018
debian Debian/Ubuntu Linux: Find If Installed APT Package Includes a Fix/Patch Via CVE Number
Viewed 9599 times since Sun, Sep 23, 2018
Using grep to find string in files
Viewed 2389 times since Fri, May 15, 2020
Transform XML to CSV Format | Unix String Pattern Manipulation The Ugly Way
Viewed 5919 times since Sun, Jan 9, 2022
Fix rpmdb: Thread died in Berkeley DB library
Viewed 21261 times since Fri, Feb 14, 2020