Hardening Linux Boot: Securing GRUB, Single-User Mode, and Console Hotkeys
Physical access to a Linux machine often guarantees total system compromise if boot configurations remain unhardened. By default, anyone with physical or KVM console access can interrupt the GRUB bootloader, append single, init=/bin/sh, or emergency to the kernel arguments, and bypass authentication into a root shell. Securing the boot process requires hardening three independent layers: Password-protecting the GRUB bootloader Requiring authentication for single-user/emergency mode Disabling interactive startup prompts and console reboot hotkeys 1. Password-Protecting Single-User Mode (sulogin) In legacy SysVinit/Upstart configurations (/etc/sysconfig/init): ...