5

I once read that you can modify a file on the computer to make Single User Mode behave differently, called "boot.rc" or something similar. Is it possible to modify the behavior of SUM? Since physical access would compromise all security (except FileVault) is it possible to prevent SUM from running bash and immediately boot into the GUI (or at least into something which requests a password) so potential hackers would have no way to gain root access without a password?

5
  • Is there anything you tried already? – Ruskes Jun 28 '14 at 8:03
  • Not yet, I couldn't find the file I mentioned in the post (hence the doubt in the filename). Also I don't exactly have the time and resources to risk messing up the OS on a Mac computer – Arc676 Jun 28 '14 at 9:41
  • What version of OS X are you running? On Lion there is no rc.boot, the start-up script is /etc/rc.common but I think most of rc.boot responsibilities are going to launchd in the future. – Brian Duke Jun 28 '14 at 19:48
  • Mac OS X 10.9.3 (Mavericks) – Arc676 Jun 29 '14 at 4:56
  • This is horribly outdated, but did exactly this a decade ago. web.archive.org/web/20110308060401/http://users.ez-net.com/… – bot47 Jun 29 '14 at 12:13
5

You can add a firmware password, which will need to be entered before the Mac can be booted into Single User Mode (or from external media). Boot with ⌘R to enter Recovery, then select Firmware Password Utility from the Utilities menu to set it up.

3

Another option is to enable FileVault 2. It makes entering single user mode require the login password of an account that is allowed to unlock the disk.

2

You can set a firmware password, which will prevent booting to single user, verbose, boot selector, target firewire/thunderbolt, etc. Here's how:

http://osxdaily.com/2014/01/06/set-firmware-password-mac/

4
  • 1
    Better use FileVault to encrypt you disk. – bbaassssiiee Jun 28 '14 at 15:03
  • Why is this better? No reason not to use both. – bot47 Jun 29 '14 at 11:47
  • 2
    FileVault will protect the content even if the hard disk is removed. A firmware password will only prevent the machine to boot. – Matteo Jun 29 '14 at 11:55
  • But it does not prevent a thief from using your computer. A firmware password will render it useless. So use both. – bot47 Jun 29 '14 at 12:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .