Ok, I figured it out. So this is how login works. There is an init script in /etc/init/tty1.conf
which runs getty. Getty is a program that waits for login connections, and then authenticates a user. I initially thought getty was being run with autologin, and so I looked for a line in /etc/init/tty1.conf
like
exec /sbin/getty -8 38400 -a root tty1
which means, open an 8bit terminal at 38400 baud and autologin the root user into tty1. But when I looked at the file, there was no -a
option to autologin the root user. I'm stating this because /etc/init/tty1.conf
should be the first place to look if others face the same issue.
Then I looked through the /etc/init/
directory and found a file called openvt.conf
. This had the following line:
exec /bin/login -f root
This was the culprit. The login command with the -f
option automatically logs the user in without authentication.
Since the openvt.conf
file is intended to be an upstart service, it has to be disabled in a particular way, although one can also simply delete the file. See this askubuntu post about upstart. In short, either delete the openvt.conf
file, or run
echo manual | sudo tee /etc/init/openvt.override
and then root is no longer logged in automatically.