17

When I boot system in to recovery mode from GRUB menu, I can get in to all powerful root without entering any password, thus insecure.

How I can secure this and ensure that a password is asked every time I attempt to access root in recovery mode?

2
  • Do you need anymore clarifications? Mar 27, 2011 at 20:45
  • Can someone please clarify how to do this in 14.04 LTS? I tried it, following the instructions at help.ubuntu.com/community/Grub2/Passwords#Password_Encryption so the password was not stored in plain text, and was unable to boot the machine at all - it wouldn't recognize the password. Also, I don't want to password protect ALL booting, just recovery. Yes, I know that it's not entirely secure, but I have a requirement handed down from above to password-protect recovery.
    – betseyb
    May 7, 2015 at 18:28

3 Answers 3

11

There is a post on Ubuntu forums about protecting entries by password, basically to make the recovery menuitems require you to login as superman with password 1234 you need to edit some very hairy config/script files:

Add to /etc/grub.d/00_header

cat << EOF
set superusers="superman"
password superman 1234
password bill 5678
EOF 

Change /etc/grub.d/10_linux

From:

printf "menuentry '${title}' ${CLASS} {\n" "${os}" "${version}"

To:

if ${recovery} ; then
   printf "menuentry '${title}' --users superman ${CLASS} {\n" "${os}" "${version}"
else
   printf "menuentry '${title}' ${CLASS} {\n" "${os}" "${version}"
fi 

Perfecting protection is profoundly hard

Other things you need to do is to password protect your bios, disable booting from anything else than primary hard drive, and encrypt your root partition and mount any other partition as noexec. This still leaves lots of vectors.

2
  • That looks promising. Will check that.
    – Jamess
    Mar 23, 2011 at 11:25
  • I can't find that line what so ever @Ron Aug 17, 2015 at 16:44
2

The only reliable way to protect the system from an attacker having physical access to the machine is full-disk encryption.

4
  • Or locking down the BIOS Mar 24, 2011 at 0:03
  • 1
    It's trivial to reset the BIOS password once you have access to the hardware. However, a disk encrypted with a good passphrase (immune to a dictionary attack) will remain secure as long as AES is secure. Mar 24, 2011 at 8:35
  • Not really easy because you will often need tools and another computer to do it. Mar 24, 2011 at 21:59
  • It all depends on a threat model. Mar 24, 2011 at 23:03
0

You can't protect your data if it's not encrypted, but you can protect root user. When anyone try to access your disk via recovery mode, she/he needs password.

set root password

sudo passwd root #set new password for user named root

test root access

su

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .