2

Is there a way to require a password to login to single user mode? I don't want to use a firmware password, because that will not only disable single user mode, but also Startup Manager (which I use to boot from a USB). I don't like the idea of anyone with physical access to my computer having more privileges than my user does.

I'd simply like to have it ask for the root password before logging in as root, or ask for any username and password, and log them in normally. Is there a way to do this?

Improve this question
3
  • 1
    I don't have a direct answer to your question, but what you could do - to at least have a password authentication - is encrypting your hard drive (either using built-in FileVault2 or some other encryption software). Since we talk about a full disc encryption here you will be prompted for a password immediately after turning on the Mac (pre-boot authentication). If you want to protect your data you should use full disc encryption anyway, because without it no password will rescue your data if one has two minutes physical access to your Mac and wants to steal your data. Encryption does.
    – cyphorious
    Commented Feb 19, 2013 at 15:05
  • @cyphorious I'm not so much worried about data theft (private files are in an encrypted dmg), but if you need the key to even boot, that could work well. Does full-disk encryption slow things down? For example, does the entire OS need to be loaded to memory?
    – tkbx
    Commented Feb 19, 2013 at 15:19
  • Full disc-encryption of course comes with the "disadvantage" that every read and write operation from and to the HDD has to be en/decrypted. The algorithms are pretty fast and so is the hardware IMHO. I use my MacBook >10 hours a day and don't feel that it slowed down compared to the time I didn't use full disc encryption (using 8GB RAM). But there may be usecases where one does feel some drawbacks. I do a lot of software development, office work,... and don't feel disadvantages.
    – cyphorious
    Commented Feb 19, 2013 at 17:42

2 Answers 2

Reset to default
3

The following article may help your problem. :)

Mac OS X: Require Password at Single User Mode:

By default, Mac OS X will simply give you a shell when you perform a Single User Mode startup. However, you can force OS X to ask for a password in order to gain shell access. To do so, vi the /etc/ttys and change secure to insecure. Once you have done so, create a password in /etc/master.passwd for root.

Improve this answer
0

An alternate solution that will in effect disable Single-User Mode without using an EFI password...

I edited /var/root/.profile and added the command

shutdown -r now

When the machine boots into SUM, this script runs and the machine restarts. More reporting or functions can easily be added. For a great example of this, check out Jacob Salmela's script.

Improve this answer
2
  • This is trivial to bypass -- the machine can still be booted into recovery mode, and the .profile can be deleted from there.
    – user101978
    Commented May 29, 2018 at 19:55
  • @duskwuff - Thank you for your input. Good to know for all who use this. My purpose is to make it more difficult for middle school students to experiment with single user mode. I hadn't thought about having root access via Recovery mode terminal.
    – Tim Dearborn
    Commented May 30, 2018 at 16:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .