Detections
Analytics

1.4.3 Ensure authentication is required when booting into rescue mode

Information

Rescue mode (single-user mode) boots the system into a minimal environment for administrative maintenance and provides a root shell. When rescue.service is configured to run sulogin (via systemd-sulogin-shell ), the root password must be entered before the rescue shell is granted.

Rescue mode grants full root access to the system. If authentication is not required to enter it, anyone able to boot the host into rescue mode is granted root access to all files on the system without credentials. Requiring the root password (via sulogin ) before the maintenance shell is presented ensures only authorized administrators can use rescue mode.

Solution

Ensure the root account has a valid password set, then require authentication for rescue mode by creating a systemd drop-in override.

Create or edit /etc/systemd/system/rescue.service.d/00-require-auth.conf with the following content:

[Service]
ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue

Reload the systemd manager configuration:

# systemctl daemon-reload

Impact:

An administrator entering rescue mode from the console will be prompted for the root password. This control requires the root account to have a valid password and is therefore incompatible with locking the root account - on a system with a locked or empty root password, sulogin will refuse rescue-mode access and recovery will require boot media (or provider/console recovery). Sites that lock the root account should document a deviation or rely on boot-media recovery.

See Also

https://workbench.cisecurity.org/benchmarks/27890

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-3

Plugin: Unix

Control ID: 96979f9257367ed13d52fc645780cbb30c2a8794f9e7e787a15224b482dfa1d6