How to get a secure console login prompt on PI 3

[sgrayban]

Actually I did find how to do this....

edit /etc/systemd/system/autologin@.service

find [Service]

edit
ExecStart=-/sbin/agetty --autologin pi --noclear %I $TERM
change to
ExecStart=-/sbin/agetty %I $TERM

Reboot

Now your PI 3 will boot and have a secure console login.

NOTE: The screen doesn't clear like a normal debian login and I can't figure out how to do that without editing rc.local and adding a clear command so it's just cosmetic by product for now.

[n67]

Need some more details.

Which OS?
How did you install it? How did you configure it?

Is it connected to network?

When you say "console login", do you mean exactly a "virtual console" login?
Maybe post a screen shot, just to make sure we're all talking about the same thing.

[sgrayban]

I figured it out... PI enables auto login no matter what I change in the raspi-config

I edited this post to reflect the right way to do this.

[mfa298]

Actually I did find how to do this....

edit /etc/systemd/system/autologin@.service

find [Service]

edit
ExecStart=-/sbin/agetty --autologin pi --noclear %I $TERM
change to
ExecStart=-/sbin/agetty %I $TERM

Reboot

Now your PI 3 will boot and have a secure console login.

NOTE: The screen doesn't clear like a normal debian login and I can't figure out how to do that without editing rc.local and adding a clear command so it's just cosmetic by product for now.

You shouldn't have to go editing systemd service files to change that functionality. If you look at what raspi-config does for console autologin it changes the path for /etc/systemd/system/getty.target.wants/getty@tty1.service If that's not working. To disable autologin it should point to /lib/systemd/system/getty@.service which is effectively the same as your change.

The issue with your method is that if the package owning the file you altered gets updated (which happens a few times a year) your change could get put back to the default.