Rule ID
SV-269139r1137691_rule
Version
V1R6
CCIs
This requirement prevents attackers with physical access from easily bypassing security on the machine and gaining root access. Such accesses are further prevented by configuring the bootloader password.
Verify that AlmaLinux OS 9 requires authentication for single-user mode with the following command: $ grep -E 'ExecStart.*sulogin' /usr/lib/systemd/system/rescue.service ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue If this line is not returned or is commented out, this is a finding.
Configure AlmaLinux OS 9 to require authentication for single-user mode. Add or modify the following line in the "/usr/lib/systemd/system/rescue.service" file: ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue "sudo systemctl edit rescue.service" can also be used to create a "/etc/systemd/system/rescue.service.d/override.conf" file.