Security for /etc/lilo.conf
A little tip for physical security inside the /etc/lilo.conf
Anyone who uses lilo as a boot manager, has the option to edit a line at the lilo prompt aswell as choosing the available options.
If at the lilo prompt, let us say you were to type in
init=/bin/bash
that would open a direct root shell on the machine, making it possible to copy the /etc/shadow onto a floppy in order to crack it at a later point. To prevent that, inside /etc/lilo.conf edit the following lines.
password = hard_to_guess_password_here
restricted
The first option (password) will ask for the password every time you reboot the computer in order to choose an option, or to enter a syntax in lilo. Now, what if its on a server, the power fails, and it reboots automatically and no one is there to enter the lilo password. This is where the second line is important.
restriced
meaning that it will only ask for a password if you try to enter a line such as ( init=/bin/bash) or any other command (you can still choose the standard available options without the need to enter a password, letting the computer reboot normally by itself). This is an important step for computers which are accesible physically. The same applies for the GRUB boot manager.
Hope this helps.