Like most programs, the Linux kernel itself can take 'command line'
arguments. These arguments can be specified when you select your kernel
at boot time, for example:

lilo: linux single

The command above tells lilo to run the Linux kernel with the argument
'single', which means single user mode. In this situation, linux will
load and enter run state 1. (In fact, you could have said '1' instead of
'single'.) In single user mode, the root filesystem is mounted
read-only, the network isn't initialized, and no daemons are running.
It's the perfect situation for you to fix problems that are keeping your
machine from booting.

When you enter single user mode, you are automatically dropped into a
root shell, without typing a password. Unfortunately, anyone with
physical access can easily get a root shell his way.

This problem has two solutions:

1) Configure lilo to prevent folks from sending arguments to the
kernel at the lilo prompt.
You specify 'restricted' in the image specification and pick a
password. They can still choose to boot this image, but they cannot boot
send it command line options unless they know this password. Your image
definition will look something like this:

image=/boot/vmlinuz
label=linux
restricted
password=SuperSecretPassword
read-only
root=/dev/hda7

If you choose this method, make sure you:

# chmod 600 /etc/lilo.conf

This prevents users from reading the password. Then re-write your lilo
configuration with:

# lilo

2) Force root to type the root password, even when entering single
user mode.
This involves running sulogin when the machine enters run level
zero. Add the following to /etc/inittab:

~~:S:wait:/sbin/sulogin

This command tells init (the first process that starts when linux is
booted) to run the sulogin program automatically. sulogin prints the
following to your tty:

Give root password for system maintenance
(or type Control-D for normal startup):

If you know the root pw, you are dropped to a root shell. If not, then
sorry -- no root for you.

It's important to remember that this method handily prevents you from
entering your own system in single user mode if you forget the root
password! [1]

NOTES

[1] If sulogin determines that there is no usable root password in
/etc/shadow or /etc/passwd because the files have been horribly mangled,
then it will give you root access automatically because no valid
authentication is possible.

» posted by ITworld staff

ITworld

• Email
• Print
• Share
  • Slashdot
  • Digg
  • Stumble
  • Reddit
  • Newsvine