Description
Single-user mode is intended as a system recovery
method, providing a single user root access to the system by
providing a boot option at startup.
By default, single-user mode is protected by requiring a password and is set
in /usr/lib/systemd/system/rescue.service.
Rationale
This prevents attackers with physical access from trivially bypassing security
on the machine and gaining root access. Such accesses are further prevented
by configuring the bootloader password.
- ID
xccdf_org.ssgproject.content_rule_require_singleuser_auth
- References
CSC: Critical Security Controls
COBIT®: Control Objectives for Information and Related Technologies
SP 800-171 Rev. 1: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
CCI: Control Correlation Identifier
HIPAA: Health Insurance Portability and Accountability Act
ISA-62443-2-1-2009, Security for Industrial Automation and Control Systems Part 2-1: Establishing an Industrial Automation and Control Systems Security Program
ANSI/ISA-62443-3-3 (99.03.03)-2013 Security for industrial automation and control systems Part 3-3: System security requirements and security levels
ISM: Information Security Manual
CIP: Critical Infrastructure Protection
NIST Special Publication 800-53 (Revision 4): Security and Privacy Controls for Federal Information Systems and Organizations
Framework for Improving Critical Infrastructure Cybersecurity
OSPP: Protection Profile for General Purpose Operating Systems
GPOS SRG: General Purpose Operating System Security Requirements Guide
CCE: Common Configuration Enumeration