5

I once read that you can modify a file on the computer to make Single User Mode behave differently, called "boot.rc" or something similar. Is it possible to modify the behavior of SUM? Since physical access would compromise all security (except FileVault) is it possible to prevent SUM from running bash and immediately boot into the GUI (or at least into something which requests a password) so potential hackers would have no way to gain root access without a password?

Improve this question
5
  • Is there anything you tried already?
    – Ruskes
    Jun 28, 2014 at 8:03
  • Not yet, I couldn't find the file I mentioned in the post (hence the doubt in the filename). Also I don't exactly have the time and resources to risk messing up the OS on a Mac computer
    – Arc676
    Jun 28, 2014 at 9:41
  • What version of OS X are you running? On Lion there is no rc.boot, the start-up script is /etc/rc.common but I think most of rc.boot responsibilities are going to launchd in the future.
    – Brian Duke
    Jun 28, 2014 at 19:48
  • Mac OS X 10.9.3 (Mavericks)
    – Arc676
    Jun 29, 2014 at 4:56
  • This is horribly outdated, but did exactly this a decade ago. web.archive.org/web/20110308060401/http://users.ez-net.com/…
    – bot47
    Jun 29, 2014 at 12:13

3 Answers 3

Reset to default
5

You can add a firmware password, which will need to be entered before the Mac can be booted into Single User Mode (or from external media). Boot with ⌘R to enter Recovery, then select Firmware Password Utility from the Utilities menu to set it up.

Improve this answer
3

Another option is to enable FileVault 2. It makes entering single user mode require the login password of an account that is allowed to unlock the disk.

Improve this answer
2

You can set a firmware password, which will prevent booting to single user, verbose, boot selector, target firewire/thunderbolt, etc. Here's how:

http://osxdaily.com/2014/01/06/set-firmware-password-mac/

Improve this answer
4
  • 1
    Better use FileVault to encrypt you disk.
    – bbaassssiiee
    Jun 28, 2014 at 15:03
  • Why is this better? No reason not to use both.
    – bot47
    Jun 29, 2014 at 11:47
  • 2
    FileVault will protect the content even if the hard disk is removed. A firmware password will only prevent the machine to boot.
    – Matteo
    Jun 29, 2014 at 11:55
  • But it does not prevent a thief from using your computer. A firmware password will render it useless. So use both.
    – bot47
    Jun 29, 2014 at 12:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .