Detections
Analytics

1.4.4 Ensure authentication is required when booting into emergency mode

Information

Emergency mode boots the system into the most minimal environment - before most filesystems are mounted - and provides a root shell. When emergency.service is configured to run sulogin (via systemd-sulogin-shell ), the root password must be entered before the emergency shell is granted.

Emergency mode grants full root access to the system. If authentication is not required to enter it, anyone able to boot the host into emergency mode is granted root access to all files on the system without credentials. Requiring the root password (via sulogin ) before the maintenance shell is presented ensures only authorized administrators can use emergency mode.

Solution

Ensure the root account has a valid password set, then require authentication for emergency mode by creating a systemd drop-in override.

Create or edit /etc/systemd/system/emergency.service.d/00-require-auth.conf with the following content:

[Service]
ExecStart=-/usr/lib/systemd/systemd-sulogin-shell emergency

Reload the systemd manager configuration:

# systemctl daemon-reload

Impact:

An administrator entering emergency mode from the console will be prompted for the root password. This control requires the root account to have a valid password and is therefore incompatible with locking the root account - on a system with a locked or empty root password, sulogin will refuse emergency-mode access and recovery will require boot media (or provider/console recovery). Sites that lock the root account should document a deviation or rely on boot-media recovery.

See Also

https://workbench.cisecurity.org/benchmarks/27892

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-3

Plugin: Unix

Control ID: 23fd6fa7c613229d5b36ee721c224ecde4622e7596dc46092b5fb07cfb25a71a