I have learned that I can boot into single user mode (or whatever it's called) by hitting Ctrl+e in the Grub2 menu and adding single to the correct line in the boot script. This is all good - it's saved me a bunch of times when I screwed something up :P

However, I've noticed that when I do this, I get root access basically for free - I never have to enter a password or otherwise prove my identity. This feels unsafe - the keyboard command to edit the boot script is common knowledge, so anyone with access to my computer can just turn it off (forcibly, if needed, via the power button) and on again, edit the boot script and have root access to my computer.

I don't want that.

What do I need to configure in order to force a password for single user sessions?

(I'ts probably not relevant, but I've set my startup options so that I boot straight into the desktop, skipping the login screen. This is OK, since I still need to type a password to sudo, but I don't like the idea of giving anyone root access that easily...)