DISA STIGS Viewer

AlmaLinux OS 9 must require authentication to access single-user mode.

Overview

Finding ID Version Rule ID IA Controls Severity
V-269139 ALMA-09-006510 SV-269139r1050021_rule   Medium
Description
This requirement prevents attackers with physical access from easily bypassing security on the machine and gaining root access. Such accesses are further prevented by configuring the bootloader password.
STIG Date
CloudLinux AlmaLinux OS 9 Security Technical Implementation Guide 2025-05-22

Details

Check Text (C-73170r1049178_chk)
Verify that AlmaLinux OS 9 requires authentication for single-user mode with the following command:

$ grep -E 'ExecStart.*sulogin' /usr/lib/systemd/system/rescue.service

ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue

If this line is not returned or is commented out, this is a finding.
Fix Text (F-73071r1049179_fix)
Configure AlmaLinux OS 9 to require authentication for single-user mode.

Add or modify the following line in the "/usr/lib/systemd/system/rescue.service" file:

ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue

"sudo systemctl edit rescue.service" can also be used to create a "/etc/systemd/system/rescue.service.d/override.conf" file.