Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

By default, Macs are extremely insecure if somebody can get physical access, as they can simply shut it down, press the power button, hold command-S, and there, they get root access in 5 seconds.

Is there a way to disable the single-user boot mode, or at least password-protect it?

share|improve this question

2 Answers 2

up vote 9 down vote accepted

The best you can do is set a firmware password in hopes that someone won't change the boot options stored in NVRAM or let the keyboard select an alternate software to boot and bypass your administrative passwords.

Older macs use Open Firmware to enforce this password, newer ones use EFI Password to prevent booting into single user mode.

Physical access means with tools, your mac is vulnerable to physically reset the firmware password or remove the drive. To protect there, consider FileVault which encrypts the contents of your disk and requires the correct password regardless of physical access to the mac.

share|improve this answer

With complete physical access, all bets are off regarding security of booting. Make sure that the data or user accounts that you care about are encrypted (filevault, et.al.) so that the bits on the disk are more likely useless without a password.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.