1

I used Ubuntu to build a Wifi HotSpot. You can join the Wifi and access Internet. It is used in some area without lots of Internet access in Africa, Island and Greenland.

Since we're responsible for lots of law things (I dont detail), I have to ensure the Wifi hotspot is nor hacked nor theft. I crypted it all with LUKS, and I put the keyfile on a USB pendrive. But someone can still come with a screen-keyboard-mouse stuff and go to the FS.

Therefore, I aim to avoid anyone access the Desktop, but how can I do this ?

Note: since the system has to run automatically at boot, I cant ask for a user passwors at launch, so I disabled it (you got the desktop immediatly).

Thanks --

EDIT FYI, My system is in a box.

5
  • Ah, you should have told me the other answer/question was working, but not for your situation :). Will post another one here in a minute... Aug 13, 2015 at 8:22
  • @JacobVlijm Thank you, your answer was working, for the question. Rather than editing, I make this new question. I think I have to : disable Recovery mode, lock screen after [MINIMAL, ZERO?] seconds, make strong-kingkong passwords for the unique main user, root and sudos. And maybe use the server edition, but Im affraid using it, absolutely no GUI... arg.
    – 3pic
    Aug 13, 2015 at 8:27
  • Are you on the toilet that long :) No seriously, do you have to deal with a long- term unattended system? I was working (practically ready) on a script that blacked the screen, also checking for possibly (later) additionally connected screens etc. The script would run on login (either automatically login or not); meaning a log out/in would not give access, but restarting from an external medium would not be covered. I guess that is not sufficient then? Aug 13, 2015 at 8:37
  • the toilet are so confortable here ;) unattended ? absolutely. Your black-screen plugin seems quite great to me. Actually, I dont know if my daemons run after having logged or before showing the login/pwd inputs. * If my daemons run before, I can simply leave it all like that (login prompt) and put a 99 string-lenght password. * I have to investigate this way too: askubuntu.com/questions/31963/…
    – 3pic
    Aug 13, 2015 at 8:42
  • Please see if this helps you in any way. I can extend the fence a bit if this is a useful direction. Aug 13, 2015 at 9:20

2 Answers 2

1

If someone has physical access to the computer, there is no way to protect it. Put it inside a box under lock and key

For this kind of use it is best not to use Ubuntu Desktop. Use the Ubuntu server version, that has no desktop. Setup the WiFi hotspot as a service. A service (also called a daemon) starts when the computer starts and does not need anyone to log on. See How to setup an access point mode WiFi hotspot? for how to use hostapd to setup WiFi hotspot as a service.

Use strong password for admin (sudo) accounts.

If you can't do that, try WiFi hotspot available to all users. See:

enter image description here

Note, All users may connect to this network box is checked. This means this network will be online before anyone logs on. So you don't need to log on to the desktop to make it work.

Second, set up lock screen so that the screen is locked if no one uses it.

enter image description here

See Lock is set to On. You can also manually lock the screen by pressing Ctrl+Alt+L before you leave the computer.

Remember: All this is useless if someone can physically get to the computer and reboot it to recovery mode and reset your password.

Hope this helps

1
  • Thank you, what if I get a machine without USB I/O, without DVI/VGA/HDMI output. I would just have to clone my HDD to this "blind I/O" machine HDD... what about drivers ? I post a new question.
    – 3pic
    Aug 13, 2015 at 8:28
1

Turn the desktop black of all (possibly additionally) connected screens

Not sure if the solution below is sufficient to you, but as an (additional?) measure, it should help to make it at least more difficult to access the system.

As usual, it is mostly the combination of measures that makes incidental access more difficult. It could e.g be made more difficult by:

  • adding a password to "un-" blacken the screen
  • a log file to keep track of changes in screen brightness
  • change the default shortcut key to open the terminal, so "blindly" typing commands is unlikely.

At the same time, I am pretty sure however that someone with real knowledge will always find a way, if the time is sufficient, unless you completely block all connecting options by (e.g.) building the system inside some kind of a box. Only think of restarting from an external medium.

The bottom line is that you'll have to decide if it is useful to you

The solution

Exists of a background script that once per second:

  • checks all connected screens (also newly connected ones)
  • checks if all screens are set to brightness 0.0 (or 1.0, see further below)
  • sets all screens to brightness 0.0if not.

Furthermore:

  • the script reads the desired brightness value from a hidden file in your home directory
  • the solution includes two shortcut key combinations to set that value in the file to 1.0 (normal use) or 0.0 (black screen).

As mentioned, the scortcut keys can be made to use a password (in plain text). Please mention it if you find it usesfull.

The script

#!/usr/bin/env python3
import subprocess
import time
import os

screen_brightness = os.environ["HOME"]+"/.screenset.txt"
if not os.path.exists(screen_brightness):
    open(screen_brightness, "wt").write("0.0")

def read_set():
    return open(screen_brightness).read()

def get(command):
    return subprocess.check_output(["/bin/bash", "-c", command]).decode("utf-8")

def find_screens(screendata):
    return [l.split()[0] for l in screendata.splitlines() if " connected" in l]

while True:
    time.sleep(1)
    curr_set = read_set()
    screendata = get("xrandr --verbose")
    n_screens = screendata.count(" connected")
    n_dimmed = screendata.count("Brightness: "+curr_set)
    if n_dimmed != n_screens:
        screens = find_screens(screendata)
        for scr in screens:
            subprocess.Popen(["xrandr", "--output", scr, "--brightness", curr_set])

How to set up

  1. Copy the script into a empty file, save it as black_screen.py
  2. Create two shortcut keys (commands):

    echo 1.0 > ~/.screenset.txt
    

    and:

    echo 0.0 > ~/.screenset.txt
    

    Choose: System Settings > "Keyboard" > "Shortcuts" > "Custom Shortcuts". Click the "+" and add the commands to two different shortcut keys.

  3. Test run the script with the command:

    python3 /path/to/black_screen.py
    
  4. If all works fine, add it to your startup applications: Dash > Startup Applications > Add the command:

    python3 /path/to/black_screen.py
    

Notes

As mentioned, the script / setup can be made more secure with a (plain text) password and/or a log file. Please look if this is a useful direction.

2
  • Thank you for the detailed answer. There is a failure though: what if a hacker plug a static screen (with no brightness control).
    – 3pic
    Aug 14, 2015 at 7:46
  • @Strukt I cannot test it, since I have no screen of that type, but via xrandr, brightness should be always controlled, no matter the type of screen. xrandr does not use the monitor's options, but simply controls what the monitor gets. Can you test it? Aug 14, 2015 at 7:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .