Singel usermode über ttys absichern in Tiger nicht möglich?

[Tzunami]

Hoffe hier sind findige Unicer die mir helfen können.

Ich habe in 10.3 das booten im SU Mode mithilfe der ttys mit eine Passwort versehen. nur leider scheint das unter 10.4 nicht mehr zu funzen. Meine ttys sieht so aus (Text geht darunter weiter):

# @(#)ttys 5.2 (Berkeley) 6/10/93
#
# name getty type status comments
#
# To secure single-user mode, enable Open Firmware password protection.
# http://www.apple.com/downloads/macosx/apple/openfirmwarepassword.html
# http://docs.info.apple.com/article.html?artnum=120095
#
#console "/usr/libexec/getty std.57600" vt100 on secure
console "/System/Library/CoreServices/loginwindow.app/Contents/MacOS/loginwindow" vt100 on insecure onoption="/usr/libexec/getty std.9600"
#tahoe's only
#remote "/usr/libexec/getty std.1200" pt on # diagnostics

# The tty.serial entry initializes the serial port (if any) for use as a
# terminal (enabling logons over serial). If marked secure, the serial
# port will allow root logons.
# To make the serial port available for outbound
# communications, the tty.serial entry should be turned off
# (set the 4th field to off).
tty.serial "/usr/libexec/getty serial.57600" vt100 off insecure

# Fax reception is off by default, use the
# System Preferences panel to enable it.
fax "/usr/bin/fax answer" unknown off

# Hardwired lines are marked off, by default, so getty(8)
# is quiet when they don't exist.
tty00 "/usr/libexec/getty std.9600" unknown off insecure
tty01 "/usr/libexec/getty std.9600" unknown off insecure
tty02 "/usr/libexec/getty std.9600" unknown off insecure
tty03 "/usr/libexec/getty std.9600" unknown off insecure
tty04 "/usr/libexec/getty std.9600" unknown off insecure
tty05 "/usr/libexec/getty std.9600" unknown off insecure
tty06 "/usr/libexec/getty std.9600" unknown off insecure
tty07 "/usr/libexec/getty std.9600" unknown off insecure

ttyp0 none network
ttyp1 none network
ttyp2 none network
ttyp3 none network

Zusätzlich wurde in der Datei master.passwd der * durch ein Openssl generiertes passwort ersetzt:

##
# User Database
#
# Note that this file is consulted when the system is running in single-user
# mode. At other times this information is handled by lookupd. By default,
# lookupd gets information from NetInfo, so this file will not be consulted
# unless you have changed lookupd's configuration.
##
nobody:*:-2:-2::0:0:Unprivileged User:/var/empty:/usr/bin/false
root:Hier:0:0::0:0:System Administrator:/var/root:/bin/sh
daemon:*:1:1::0:0:System Services:/var/root:/usr/bin/false
unknown:*:99:99::0:0:Unknown User:/var/empty:/usr/bin/false
lp:*:26:26::0:0rinting Services:/var/spool/cups:/usr/bin/false
postfix:*:27:27::0:0ostfix User:/var/spool/postfix:/usr/bin/false
www:*:70:70::0:0:World Wide Web Server:/Library/WebServer:/usr/bin/false
eppc:*:71:71::0:0:Apple Events User:/var/empty:/usr/bin/false
mysql:*:74:74::0:0:MySQL Server:/var/empty:/usr/bin/false
sshd:*:75:75::0:0:sshd Privilege separation:/var/empty:/usr/bin/false
qtss:*:76:76::0:0:QuickTime Streaming Server:/var/empty:/usr/bin/false

Was ist FALSCH?