When I switch to VT 9 by pressing Ctrl+Alt+F9 I get a root shell by default without a password prompt. How can I change it to demand a password before giving root shell access? I am using Ubuntu 16.04 LTS.

In Sergiy's answer he has explained the methods to open VTs with and without sudo and includes description of device files of VTs but he has not addressed this problem of mine where I have a default root shell on VT9.

Output of lsof /dev/tty9

lsof: WARNING: can't stat() fuse.gvfsd-fuse file system /run/user/1000/gvfs
      Output information may be incomplete.
COMMAND PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
bash    281 root    0u   CHR    4,9      0t0   28 /dev/tty9
bash    281 root    1u   CHR    4,9      0t0   28 /dev/tty9
bash    281 root    2u   CHR    4,9      0t0   28 /dev/tty9
bash    281 root  255u   CHR    4,9      0t0   28 /dev/tty9

Output of systemctl status getty@9

● getty@9.service - Getty on 9
   Loaded: loaded (/lib/systemd/system/getty@.service; enabled; vendor preset: enabled)
   Active: inactive (dead)
     Docs: man:agetty(8)
           man:systemd-getty-generator(8)
           http://0pointer.de/blog/projects/serial-console.html
  • VT9 should usually show log messages, and not able to open an unproctected tty. – abu_bua Jun 23 at 7:57
  • @karel I have checked out that answer but I couldn't find the reason why I am getting a root shell on VT9 by default. – Prathu Baronia Jun 23 at 9:00
  • When I try to switch to tty9 by using the command I get the error openvt: vt 9 is in use; command aborted; use openvt -f to force. . I am wondering now if it's a default thing on Ubuntu or not. It would be great if you or someone else could try it on their machine and see what happens. – Prathu Baronia Jun 23 at 9:14
  • Add the output of sudo lsof /dev/tty9 and systemctl status getty@9 to the post, please. – muru Jun 23 at 13:14
  • Now try pstree -psa 281 (or whichever PID shows up in the lsof output) and systemctl status 281 – muru Jun 23 at 20:03
up vote 2 down vote accepted

This is a systemd debug shell.

debug-shell.service - Early root shell on /dev/tty9 FOR DEBUGGING ONLY

It should be disabled by default, and only enabled for debugging. You can disable it with

# systemctl disable debug-shell.service
New contributor
Lars Øyvind Hagland is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.