Re: Adding Password Protection to Single User Mode

Hi Valdrin,

On Wed, Jul 07, 2021 at 06:44:46AM +0000, Valdrin MUJA wrote:
| Thanks for suggestions,
| I removed the "secure" from /etc/ttys but I can still use "boot -s"
| without password. Is this about console connection?

Please carefully read https://man.openbsd.org/ttys.5:

> secure If on is also specified, allows users with a UID of 0 to
> log in on this line. If set for the console entry, then
> init(8) will start a single-user shell without asking for
> the superuser password.

That second sentence is very explicit. You need to take the 'secure'
keyword out of the line for the 'console' entry. The default is this:

[weerd@pom] $ grep ^console /etc/ttys
console "/usr/libexec/getty std.9600" vt220 off secure

Cheers,

Paul 'WEiRD' de Weerd

| Updated ttys file;
|
| # cat /etc/ttys | grep 115200
| tty00 "/usr/libexec/getty std.115200" vt220 off
| ________________________________
| From: Paul de Weerd <weerd@weirdnet.nl>
| Sent: Tuesday, July 6, 2021 17:36
| To: Valdrin MUJA <valdrin_muja@outlook.com>
| Cc: misc@openbsd.org <MISC@openbsd.org>
| Subject: Re: Adding Password Protection to Single User Mode
|
| On Tue, Jul 06, 2021 at 12:27:03PM +0000, Valdrin MUJA wrote:
| | Hi Folks,
| |
| | I want to add a small password protection mechanism to
| | "boot -s" (single-user mode).
| |
| | Therefore, I'm working on /sys/stand/boot/boot.c, I've written
| | some code in boot.c, and run "make", "make obj", "make install"
| | in /sys/. However, I couldn't enable my update "boot" binary on startup.
| | On startup, the default boot program is working.
| |
| | How can I replace my updated boot program with the default one?
| |
| | P.S.: I've tried compile and install kernel and the result didn't change.
|
| After building a new boot loader, you will need to use installboot(8)
| to actually install said code into the system. Your `make install`
| merely placed the bootloader into the spot in the filesystem where
| installboot expects to find it, but won't do the special editing of
| the disk that installboot does.
|
| (but also see the replies from others about ttys(5) to deal with your
| situation without potentially screwing up your entire system with a
| faulty bootloader)
|
| Cheers,
|
| Paul 'WEiRD' de Weerd
|
| --
| >++++++++[<++++++++++>-]<+++++++.>+++[<------>-]<.>+++[<+
| +++++++++++>-]<.>++[<------------>-]<+.--------------.[-]
| http://www.weirdnet.nl/

--
>++++++++[<++++++++++>-]<+++++++.>+++[<------>-]<.>+++[<+
+++++++++++>-]<.>++[<------------>-]<+.--------------.[-]
http://www.weirdnet.nl/