Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I have learned that I can boot into single user mode (or whatever it's called) by hitting Ctrl+e in the Grub2 menu and adding single to the correct line in the boot script. This is all good - it's saved me a bunch of times when I screwed something up :P

However, I've noticed that when I do this, I get root access basically for free - I never have to enter a password or otherwise prove my identity. This feels unsafe - the keyboard command to edit the boot script is common knowledge, so anyone with access to my computer can just turn it off (forcibly, if needed, via the power button) and on again, edit the boot script and have root access to my computer.

I don't want that.

What do I need to configure in order to force a password for single user sessions?

(I'ts probably not relevant, but I've set my startup options so that I boot straight into the desktop, skipping the login screen. This is OK, since I still need to type a password to sudo, but I don't like the idea of giving anyone root access that easily...)

share|improve this question

3 Answers 3

up vote 3 down vote accepted

If you set a password for the root user, that password will be required also to login in single-user-mode.

share|improve this answer
    
And how do I do that? –  Tomas Lycken Mar 22 '12 at 10:38
1  
@TomasLycken: you can set a root password from command line with the command sudo passwd root, it will ask to type in twice the new password. –  enzotib Mar 22 '12 at 10:48

There is a fairly thorough guide on adding a password to grub on UbuntuForums.

There are probably other options tailored toward the single user prompt but however you handle things there, it's not really security. Somebody could just stick a Live stick or CD in and they suddenly have root access and all your data. Or the could pull the disk (takes seconds) and plug it into another computer.

Let's be paranoid for a minute. Consider how long it would take to:

  • Take the side off your computer,
  • Remove the cables from the drive,
  • Plug in a SATA->USB adapter to bridge the drive to a laptop,
  • Mount the drive
  • Change whatever you want
  • Unmount and replace original cables and PC case.

With physical access, I reckon I could access your data and disappear within two minutes. Perhaps a little longer if it's a laptop with 200 screws between me and the disk. If you're carrying valuable, sensitive data around (or leaving it on an unattended desktop), that should be a scary thought.

The best deterrent is full disk encryption via something like LUKS:

Even if somebody tries something, it's a nightmare to decode (remember that if you don't do backups - standard data-recovery techniques will not work). They won't have time to do anything on site, a disk clone takes hours for most disks and even if they just lift the disk, that gives you the opportunity to run around changing passwords, accounts, etc that may be made insecure by the data on that disk.

share|improve this answer
    
I will definitely look into disk encryption next time I reinstall operative systems on this computer. However, at the moment I'm only after setting a password for the root user, since all disk encryption options seem to require a full wipeout of the file system first and that's not really an option I can afford today. As a summer project, maybe :P –  Tomas Lycken Mar 22 '12 at 10:41

Full disk encryption with a key-file on a thumbdrive would do it as long as you don't leave it plugged in.

Locking grub is covered here. I don't believe in locking grub since all it takes is a live DVD/CD/Thumbdrive.

share|improve this answer
    
OK. Most of the information I find on disk encryption seem to assume that you think of this already at install-time. Is there any way to enforce encryption without having to reinstall everything? Could you point me to any good resources? If not, is there any other way to lock root access? (I would be OK with a solution that can be overriden with a live CD/USB, since then at least it takes one more step of preparation, so it can't be done while I'm on the loo...) –  Tomas Lycken Mar 22 '12 at 0:21
    
For an it can be overridden with live media check the "here" link. For migrating to FDE I'ld have to look...I'm a little used to doing things manually, and I don't think that's what you want. –  hbdgaf Mar 22 '12 at 1:07

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.