cyberstrikeus 1.3.1 Ensure authentication required for single user mode (Automated)
Description
Single user mode (rescue mode) is used for recovery when the system detects an issue during boot or by manual selection from the bootloader.
Rationale
Requiring authentication in single user mode (rescue mode) prevents an unauthorized user from rebooting the system into single user to gain root privileges without credentials.
Audit Procedure
Run the following commands and verify that /sbin/sulogin or /usr/sbin/sulogin is used as shown:
# grep /systemd-sulogin-shell /usr/lib/systemd/system/rescue.service
ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue
# grep /systemd-sulogin-shell /usr/lib/systemd/system/emergency.service
ExecStart=-/usr/lib/systemd/systemd-sulogin-shell emergency
Expected Result
The output should show ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue for rescue.service and ExecStart=-/usr/lib/systemd/systemd-sulogin-shell emergency for emergency.service.
Remediation
Rootfs is read-only file system. Therefore, update to an OS image which requires single user mode authentication.
CIS Controls
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 4.7 Manage Default Accounts on Enterprise Assets and Software | x | x | x |
| v7 | 5.1 Establish Secure Configurations | x | x | x |
Profile
Level 1 - Server | Automated