Ok, I figured it out. So this is how login works. There is an init script in
/etc/init/tty1.conf which runs getty. Getty is a program that waits for login connections, and then authenticates a user. I initially thought getty was being run with autologin, and so I looked for a line in
exec /sbin/getty -8 38400 -a root tty1
which means, open an 8bit terminal at 38400 baud and autologin the root user into tty1. But when I looked at the file, there was no
-a option to autologin the root user. I'm stating this because
/etc/init/tty1.conf should be the first place to look if others face the same issue.
Then I looked through the
/etc/init/ directory and found a file called
openvt.conf. This had the following line:
exec /bin/login -f root
This was the culprit. The login command with the
-f option automatically logs the user in without authentication.
openvt.conf file is intended to be an upstart service, it has to be disabled in a particular way, although one can also simply delete the file. See this askubuntu post about upstart. In short, either delete the
openvt.conf file, or run
echo manual | sudo tee /etc/init/openvt.override
and then root is no longer logged in automatically.