Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there anyway to protect root password. As people know to change root password through single user mode. How can protect that no one can change password of my machine through single user mode.

share|improve this question
3  
A security guard is the standard way. –  ceejayoz Sep 28 '11 at 15:38

3 Answers 3

up vote 3 down vote accepted

While @ShaneMadden really hits on the core problem here, that given physical access all bets are off. Your next best bet would be to require password logins for single user mode. You can enable this by adding the following line to your /etc/inittab file.

~~:S:wait:/sbin/sulogin

Afterwards, whenever one enters into single user mode, the user is prompted for the root password instead of simply being dropped into a root shell.

Just keep in mind that this would simply be a protection within your security plan.

share|improve this answer

Physical access to your system is control over your system. Prevent single-user mode, and they can boot to a different OS, or pull the drive and mount it on another system, and change your password on the filesystem.

Encryption is the only way to prevent access to your data when someone can physically touch the machine. And even then, it's not bulletproof.

share|improve this answer

You can password protect grub so that people can't boot as a single user:

http://www.centos.org/docs/5/html/5.2/Deployment_Guide/s3-bootloader-grub.html

However, If you are in an environment when people can access your machine without restrictions, then you have a problem with onsite security that you need to address. Short of encrypting your drive, your data will always have that risk of being physically compromised.

share|improve this answer
    
I know, that we can set password for grub. I want to know something other than this if possible. –  User4283 Sep 28 '11 at 1:04
    
Scott Pack: I also found this "su:S:wait:/sbin/sulogin -p" –  User4283 Oct 2 '11 at 15:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.