On Ubuntu 10.10 I can login as root without the root password by replacing
ro quiet splash with
rw init=/bin/bash. How can I secure my machine and disable this backdoor?
migrated from stackoverflow.com Jul 23 '11 at 18:05
You need to secure several things, as leaving any of these open introduces a door (it's not really a backdoor since it's all well documented) of similar impact. (Exception: if at step 1 you can physically secure the console as well, then you don't need to do anything else.)
Steps 1 and 2 are about your hardware and not about the operating system, so if you have trouble with them, ask on Super User. For step 3, what to do depends on your bootloader (which you haven't indicated). The default bootloader on Ubuntu is Grub 2.
First, generate a password hash with
Next, declare a user and password by creating an executable (mod 755 or 700) file called
Only authenticated superusers may edit menu entries or enter a command line. Other users may only boot prepared entries.
If you want to also restrict some boot entries to authenticated user, replace
When you've made changes in