I am running Ubuntu 12.04 - 64bit - Gnome3 as my preferred Operating System at work. However after recently taking time off, I return to my desk finding my machine was broken in to (I am also told it took most of an afternoon to do).
The very first thing I did was removed root access, simply
passwd -u root. The second thing I did was create a new user with 'sudo' access
adduser fkchu. I finally modified the sudoers file
visudo only granting fkchu access to sudo (root didn't even have this access).
Thus, to access root privileges one would; a) login my normal user providing a fairly strong password, then would require to
su fkchu using a second, very different strong password. Only then, this user can use
Big problem (I hope to be advised)
Despite arriving to work with my background changed and all of my fonts Uninstalled (except from part Chinese and part French) I found my password also got changed. The only way I gained access was via:
- Booting from my installation USB drive.
I conducted the following steps:
$ cd /mnt $ fdisk -l $ mkdir i && mount /dev/sdb1 i
Thus I then accessed my hdd via
cd /mnt/i/ and put everything back such as removing the background pictures and such. Ultimately I had to reinstall because too much ended up corrupted
I will create an image of my HDD before I take another vacation, although i'm not 100% sure how to do this, and then restore an ISO later.
I also would appreciate anyones' further help on this issue if possible, on how I can prevent further pranks like this by making it even harder for someone to Google something and then break all of the things.