1.4.3 Ensure authentication required for single user mode (Not Scored)

Level 1 - Server 
Level 1 - Workstation

Single user mode (rescue mode) is used for recovery when the system detects an issue during boot or by manual selection from the bootloader.

Requiring authentication in single user mode (rescue mode) prevents an unauthorized user from rebooting the system into single user to gain root privileges without credentials.

Run the following commands and verify that /sbin/sulogin is used as shown:

# grep /sbin/sulogin /usr/lib/systemd/system/rescue.service 
ExecStart=-/bin/sh -c "/sbin/sulogin; /usr/bin/systemctl --fail --no-block default" 
# grep /sbin/sulogin /usr/lib/systemd/system/emergency.service
ExecStart=-/bin/sh -c "/sbin/sulogin; /usr/bin/systemctl --fail --no-block default"

Edit /usr/lib/systemd/system/rescue.service and /usr/lib/systemd/system/emergency.service and set ExecStart to use /sbin/sulogin:

ExecStart=-/bin/sh -c "/sbin/sulogin; /usr/bin/systemctl --fail --no-block default"