mediumaccess-controlverified ✓

Require authentication for rescue mode

rescue-mode-authentication · RHEL ≥ 8 · 1 impl

Description

Booting into rescue (single-user) mode must require the root password. The rescue.service ExecStart must invoke systemd-sulogin-shell so a password is demanded before a rescue-mode root shell is granted.

Rationale

Without authentication on rescue mode, anyone with console or physical access can reboot into a root shell and bypass every access control on the system.

Check → Remediate

Checkcommand

grep -qE '^ExecStart=-?/usr/lib/systemd/systemd-sulogin-shell rescue' /usr/lib/systemd/system/rescue.service 2>/dev/null

expected_exit:: 0

Remediatemanual

note:: Edit /usr/lib/systemd/system/rescue.service so the ExecStart line reads "ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue", which forces a password prompt before granting a rescue-mode root shell.

Framework references

STIG

V-281328 / RHEL-10-701260V-258129 / RHEL-09-611200V-230236 / RHEL-08-010151

NIST 800-53

AC-3

Live verification

rhel8:check

#boot#rescue-mode#authentication#single-user