Runlevel    6—This  runlevel    reboots the system.Runlevel    1   (also   known   as  single-user mode    or  maintenance mode)   is  most
commonly    used    to  repair  file    systems and change  the root    password    on  a
system  when    the password    has been    forgotten.  Trespassers with    physical
access  to  the machine can also    use runlevel    1   to  access  your    system.
CAUTION
Never   forget  that    uncontrolled    physical    access  is  a   virtual guarantee   of
access  to  your    data    by  an  intruder.Booting into the Default Runlevel
Ubuntu  boots   into    runlevel    5   by  default,    which   means   it  starts  the system  as
normal  and leaves  you inside  the X   Window  System, looking at  the graphical
login   prompt. It  knows   what    runlevel    5   needs   to  load    by  looking in  the
rc*.d   directories in  /etc.   Ubuntu  contains    directories for rc0.d   through
to  rc5.d   and rcS.d.
Assuming    that    the value   is   1 ,    the rc  script  executes    all the scripts under   the
/etc/rc.1   directory   and then    launches    the graphical   login.
If  Ubuntu  is  booted  to  runlevel    1,  for example,    scripts beginning   with    the
letter  K   followed    by  scripts beginning   with    the letter  S   under   the
/etc/rc1.d  directory   are then    executed:
Click   here    to  view    code    image
matthew@seymour:~$  ls  /etc/rc1.d/
K10jackd                                K20rsync                                                    K20vboxdrv          K80cups
S70pppd-dns
K15pulseaudio           K20saned                                                    K20winbind          README
S90single
K20acpi-support K20saslauthd                                    K74bluetooth    S30killprocs
K20kerneloops           K20speech-dispatcher    K77ntp                          S70dns-clean
These   scripts,    as  with    all scripts in  the rc*.d   directories,    are actually
symbolic    links   to  system  service scripts that    reside  in  the /etc/init.d
directory.
The rc1.d   links   are prefaced    with    a   letter  and number, such    as  K15 or  S10.
The K   or  S   in  these   prefixes    indicates   whether a   particular  service should  be
killed  (K) or  started (S) and pass    a   value   of  stop    or  start   to  the
appropriate /etc/init.d script. The number  in  the prefix  executes    the
specific    /etc/init.d scripts in  a   particular  order.  The symlinks    have
numbers to  delineate   the order   in  which   they    are started.    Nothing is  sacred