Booting to Unix in OSX 10.4.8

Question

Hi, I'm new to Mac but not new to computers or unix.
I was surprised to find that booting into single-user mode avails any user of root access with no login!
Yes, it's initially read-only. That may prevent damage but it's still insecure!
When I try verbose mode at bootup with Option+V, it takes me to a GUI login and then into Aqua. Not where I wanted to go. (If I want to see this data I can always use dmesg and be able to read it before it's gone in a flash!)
I want to secure the single-user mode by requiring a login. (of course!) But I'm not sure how to do this in Darwin. I want to be able to log in not only as root but as a normal user as well. But most importantly, I want to secure it so that root access is not granted to just anyone who knows how to boot to a command line in char mode. Can someone help me here?
Also I would like to be able to boot in verbose multi-user mode without being forced to go into Aqua. I think an earlier version of the firmware or OS allowed this because someone in an apple store showed it to me about a year ago. (I think it used an F2 key combination but I can't get that to work on my MacBook. Probably was on a G4 or G5. Mine is Intel.)
I just want to have the security as well as having the char mode when I want it since I'm comfortable there for certain things.
Thanks much for any guidance!
jamie
MacBook   Mac OS X (10.4.8)  

Answer 1

I don't think it protects on a warm boot, but I'm not sure. Of course if you disable automatic login to the admin account then any warm boot or logout will default to a login screen where the user must enter a valid userid and password. You can also enable the need for a password to return from an active screensaver.
You configure all user accounts using the Accounts preference in System Preferences. You must be logged in as an admin user to change other users' accounts (except for their passwords which requires root access.) For added protection you can create two accounts for yourself. One is the admin account and the other is a standard account. They should each require different passwords (different userids, too, but that's not necessary as long as the passwords are different.) Unless you need to administer the machine, install new software or system updates, then you should always log into your standard account. Anyone trying to use your computer from the standard account will not be able to make admin or root privileged changes.
Here's some additional reading that may be useful:
http://www.macdevcenter.com/pub/a/mac/2004/02/20/security.html