Summary: While the LILO boot loader's ability to take command line arguments can allow you to repair boot problems, it can also allow unauthorized root access to your system.

Like most programs, the Linux kernel itself can take 'command line' arguments. These arguments can be specified when you select your kernel at boot time, for example:

lilo: linux single

The command above tells lilo to run the Linux kernel with the argument 'single', which means single user mode. In this situation, linux will load and enter run state 1. (In fact, you could have said '1' instead of 'single'.) In single user mode, the root filesystem is mounted read-only, the network isn't initialized, and no daemons are running. It's the perfect situation for you to fix problems that are keeping your machine from booting.

When you enter single user mode, you are automatically dropped into a root shell, without typing a password. Unfortunately, anyone with physical access can easily get a root shell his way.

This problem has two solutions:

1) Configure lilo to prevent folks from sending arguments to the kernel at the lilo prompt. You specify 'restricted' in the image specification and pick a password. They can still choose to boot this image, but they cannot boot send it command line options unless they know this password. Your image definition will look something like this:

	image=/boot/vmlinuz
	label=linux
	restricted
	password=SuperSecretPassword
	read-only
	root=/dev/hda7

If you choose this method, make sure you:

	# chmod 600 /etc/lilo.conf

This prevents users from reading the password. Then re-write your lilo configuration with:

	# lilo

2) Force root to type the root password, even when entering single user mode. This involves running sulogin when the machine enters run level zero. Add the following to /etc/inittab:

	~~:S:wait:/sbin/sulogin

This command tells init (the first process that starts when linux is booted) to run the sulogin program automatically. sulogin prints the following to your tty:

	Give root password for system maintenance
	(or type Control-D for normal startup):

If you know the root pw, you are dropped to a root shell. If not, then sorry -- no root for you.

It's important to remember that this method handily prevents you from entering your own system in single user mode if you forget the root password! [1]

NOTES

[1] If sulogin determines that there is no usable root password in /etc/shadow or /etc/passwd because the files have been horribly mangled, then it will give you root access automatically because no valid authentication is possible.

Bri Hatch is Chief Hacker at Onsight, Inc, and author of Hacking Linux Exposed and Building Linux VPNs. Bri can be reached at bri@hackinglinuxexposed.com.

Copyright Bri Hatch, 2002.

This article was first published here in ITworld.com Inc., 118 Turnpike Rd., Southborough, MA 01772  on 25-Jun-2002.