highsystemverified ✓

Require authentication for single-user mode

single-user-auth · RHEL ≥ 8 · 1 impl

Description

Single-user mode (rescue mode) must require the root password for authentication to prevent unauthorized access to the system.

Rationale

Single-user mode provides root access to the system. Without authentication, anyone with physical access could boot into single-user mode and gain full control of the system.

Check → Remediate

Checkcommand

grep -E '^ExecStart=' /usr/lib/systemd/system/rescue.service | grep -q 'sulogin'

expected_exit:: 0

Remediatemanual

note:: The rescue.service unit should use sulogin for authentication. This is the default on RHEL 8/9. If modified, restore the default: systemctl revert rescue.service

Framework references

STIG

V-258128

NIST 800-53

AC-3IA-2

Live verification

rhel8:checkrhel9:check

#authentication#single-user#rescue#physical-security