2

When I switch to VT 9 by pressing Ctrl+Alt+F9 I get a root shell by default without a password prompt. How can I change it to demand a password before giving root shell access? I am using Ubuntu 16.04 LTS.

In Sergiy's answer he has explained the methods to open VTs with and without sudo and includes description of device files of VTs but he has not addressed this problem of mine where I have a default root shell on VT9.

Output of lsof /dev/tty9 

lsof: WARNING: can't stat() fuse.gvfsd-fuse file system /run/user/1000/gvfs
      Output information may be incomplete.
COMMAND PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
bash    281 root    0u   CHR    4,9      0t0   28 /dev/tty9
bash    281 root    1u   CHR    4,9      0t0   28 /dev/tty9
bash    281 root    2u   CHR    4,9      0t0   28 /dev/tty9
bash    281 root  255u   CHR    4,9      0t0   28 /dev/tty9

Output of systemctl status getty@9

● getty@9.service - Getty on 9
   Loaded: loaded (/lib/systemd/system/getty@.service; enabled; vendor preset: enabled)
   Active: inactive (dead)
     Docs: man:agetty(8)
           man:systemd-getty-generator(8)
           http://0pointer.de/blog/projects/serial-console.html
PerlDuck
  • 13,335
Prathu Baronia
  • 2,541
  • VT9 should usually show log messages, and not able to open an unproctected tty. – abu_bua Jun 23 '18 at 07:57
  • When I try to switch to tty9 by using the command I get the error openvt: vt 9 is in use; command aborted; use openvt -f to force. . I am wondering now if it's a default thing on Ubuntu or not. It would be great if you or someone else could try it on their machine and see what happens. – Prathu Baronia Jun 23 '18 at 09:14
  • Add the output of sudo lsof /dev/tty9 and systemctl status getty@9 to the post, please. – muru Jun 23 '18 at 13:14
  • Now try pstree -psa 281 (or whichever PID shows up in the lsof output) and systemctl status 281 – muru Jun 23 '18 at 20:03

1 Answers1

3

This is a systemd debug shell.

debug-shell.service - Early root shell on /dev/tty9 FOR DEBUGGING ONLY

It should be disabled by default, and only enabled for debugging. You can disable it with

# systemctl disable debug-shell.service
Lars Øyvind Hagland
  • 46