From owner-freebsd-questions  Wed Jul 15 11:47:02 1998
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Received: (from majordom@localhost)
          by hub.freebsd.org (8.8.8/8.8.8) id LAA29965
          for freebsd-questions-outgoing; Wed, 15 Jul 1998 11:47:02 -0700 (PDT)
          (envelope-from owner-freebsd-questions@FreeBSD.ORG)
Received: from ns.cityip.co.za (ns.cityip.co.za [196.25.223.140])
          by hub.freebsd.org (8.8.8/8.8.8) with SMTP id LAA29957
          for <freebsd-questions@freebsd.org>; Wed, 15 Jul 1998 11:46:57 -0700 (PDT)
          (envelope-from wjv@cityip.co.za)
Received: from wjv by ns.cityip.co.za with local (Exim 1.82 #2)
	id 0ywWYO-0004ei-00; Wed, 15 Jul 1998 20:45:24 +0200
Message-ID: <19980715204524.B17838@cityip.co.za>
Date: Wed, 15 Jul 1998 20:45:24 +0200
From: Johann Visagie <wjv@cityip.co.za>
To: Roman Katsnelson <romank@graphnet.com>,
        Jonathan Ruxton <jonathan.ruxton@satin.net>
Cc: freebsd-questions@FreeBSD.ORG
Subject: Re: boot -s
Mail-Followup-To: Roman Katsnelson <romank@graphnet.com>,
	Jonathan Ruxton <jonathan.ruxton@satin.net>,
	freebsd-questions@FreeBSD.ORG
References: <35ACE569.284797A9@satin.net> <35ACF326.29AC4C89@graphnet.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Mailer: Mutt 0.91.1i
In-Reply-To: <35ACF326.29AC4C89@graphnet.com>; from Roman Katsnelson on Wed, Jul 15, 1998 at 02:21:26PM -0400
X-PGP: ftp://ftp.cityip.co.za/users/wjv/pubkey.asc
X-URL: http://www.cityip.co.za/~wjv/
Sender: owner-freebsd-questions@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.ORG

On Wed, 15 Jul 1998 at 14:21 SAT, Roman Katsnelson wrote:
> Jonathan Ruxton wrote:
> > 
> > Hello - I was wondering if there is an easy way to disable the -s
> > (single user mode) option at boot time for security reasons, to prevent
> > someone from changing the root password as specified in section 8.20 (
> > Eek! I forgot the root password) of the FAQ?
> 
> Hi.
> 
> I asked that question once (not too long ago) -- it didn't make sense to
> me that it should be that easy to change the root passwd. However, you

Well, a machine can never be secure from the console.  Even if you could
disable -s, someone could still boot from a floppy, mount your root
filesystem, and change root's password.

Moral:  Don't allow free access to the console.  Ever.

-- V

Johann Visagie | Email: wjv@CityIP.co.za | Tel: +27 21 419-7878

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message