Lynis Security Controls

AUTH-9308 - Protect single user mode


Physical access to the machine can be used to load alternative software or a different operating system, during the boot phase. Configure a password in the boot loader to prevent this risk. This test applies to Linux based systems only.



How to solve

For emergency maintenance and password recovery, single user mode is used on Linux systems. In such an event, the system can run a limited set of commands, and has limited access to system resources. However, this is enough to reset a root password, or try mounting a previously failed file system mount.

While single user mode is great for system engineers to performance emergency maintenance activities, it can also be abused by evildoers with access to the system. For that reason single user mode should be as limited as possible. The more sensitive data, the higher the restricted access to this feature.

Single user mode on Linux is protected in different ways. It depends on which service manager. For distributions using systemd, have a look at the related targets like rescue, console-shell, and emergency.

Related files

  • /usr/lib/systemd/system/
  • /usr/lib/systemd/system/

Perform daily health checks of your environment, learn in-depth system hardening, and protect your systems better.

Upgrade to Lynis Enterprise

Linux and Unix System Hardening

This information is provided as part of the Lynis community project. It is related to Lynis control AUTH-9308. All information should be considered as-is, without guarantees. Any advice or snippets should be tested before implementing in production environments.


Lynis is a technical security audit tool for Unix flavors like Linux, macOS, AIX, Solaris, and *BSD. It is open source software and free to use. The project has an active community, including open development via GitHub.

Lynis Enterprise

Need more advanced features, like vulnerability scanning, or reporting installed software packages? Lynis Enterprise will collect more data and present it with an easy to use web interface.

Gain additional benefits: automating security audits, reporting, and the implementation of related security measures.

Lynis Enterprise includes
  • Centralized management
  • Prioritized plans
  • Reporting
  • Dashboards
  • Integration (API)
  • Improvement snippets for tools like Ansible, Chef, Cfengine, Puppet, and SaltStack

Take the Tour