We all know that disabling access to root over ssh is essential for security, that's not what I'm referring to here.

I have seen a security best-practice recommendation to either completely disable the root password. In fact, Ubuntu has done that out of the box for years, and today Alma Linux/Rocky Linux 9 and their upstreams are doing it, too. A variation of this recommendation seems to be to frequently change the root password (I have seen somebody do it with a cron job every 30 minutes, and discard the new root password).

But there is a conflicting security best-practice: Rescue and Emergency mode should ask for the root password. For instance, Tenable will flag this as a security audit issue: https://www.tenable.com/audits/items/CIS_CentOS_8_Server_v1.0.1_L1.audit:be9c8c2631f3683628c36827045985a3

Individually, both recommendations make sense, but they conflict. Or rather, they amount to completely blocking Rescue and Emergency modes. What's the best way to reconcile those two requirements?

Note: on a technical level, I know how to get Rescue mode to not prompt for a password; just remove the sulogin from the rescue.service unit file; the tenable.com page above will implicitly show you the details.

That is not what my question is about. My question is, is it possible to accomplish both recommendations in a way I may have overlooked? Or if not, what's the "combined" best practice?

1 Answer 1


Ignore the finding that wants you to make rescue and emergency mode ask for the root password. Instead, protect your data from a local attacker who can reboot your computer by enabling full-disk encryption.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .