I had to boot single user mode today and realized I am not prompted for a password. This is a really bad security risk. Makes the system extremely vulnerable. To duplicate: at the lilo prompt type: linux single I tested this on RedHat 6.1 and Mandrake 6.1 which both allowed access to entire system as root without a password. Tested this on Caldera 2.3 and Corel 1.0, of which these systems gave the expected prompt: Give root password for maintenance (or type Control-D for normal startup): I need this fixed ASAP to certify my systems..... Thanks, Mark Williams williamsmw
A system that allows arbitrary LILO arguments cannot be secured by giving single-user mode a password; one can just boot with 'linux init=/bin/sh' and bypass all of those checks. The real solution is to set /etc/lilo.conf up to not allow extra arguments without a password. (And to force the BIOS to boot only from the HD, and to password-protect the BIOS.)
What he said. ;)