Information
If the system does not require valid root authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. GRUB 2 is the default boot loader for RHEL 7 and is designed to require a password to boot into single-user mode or make modifications to the boot menu.
Solution
Configure the system to encrypt the boot password for root.
Generate an encrypted grub2 password for root with the following command:
Note: The hash generated is an example.
# grub2-setpassword
Enter password:
Confirm password:
Edit the /boot/grub2/grub.cfg file and add or modify the following lines in the '### BEGIN /etc/grub.d/01_users ###' section:
set superusers='root'
export superusers