Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I am running Ubuntu 12.10 on my laptop and I would like to make a set up such that without a login password, no one would be able to login into my system. Currently it seems that one can, quite easily, login into Ubuntu operating system using the recovery mode, or using an Ubuntu Live USB. When I realized that the system can be logged in so easily without a password, I wonder what's the purpose of the login password anyways !

Anyhow, how can I temporarily disable recovery mode and live USB boot? If there are other ways to get into USB, I would like to know that as well.

This is to prevent my roommate from getting access to my laptop when I go for vacation. So if some logging method requires a change of password before displaying my home directory, that's a less significant security risk for me, 'cause then I wont be able to login myself and will "detect" that someone has used my system (so your friend wont do that 'cause he knows you will find out and more importantly cannot login anymore).

Also I would like to password protect USB ports temporarily so that data cannot be copied out (or a keyloger cannot be copied in) without entering my root password.

Thanks

share|improve this question
    
What brand/model is your laptop, since you want to disable a lot of ways of booting this is important to know the options available in the BIOS, since the cd/usb booting is handled there. –  Mateo Mar 17 '13 at 0:05
    
I'm not sure if you can secure any Operatig System completely against "man-in-the-middle" attacks. Maybe you'll have to look out for a more trustworthy roommate. ;-) –  speter Mar 17 '13 at 0:10
    
Tried encryption of any sort? –  Alvar Mar 17 '13 at 0:32
    
Thanks. I have a Thinkpad with no CD drive and 3 USB ports. –  eli Mar 17 '13 at 0:42
    
how do you password protect grub entries and live bootup?! –  eli Mar 17 '13 at 0:57

1 Answer 1

You seem to be concerned about attackers who are going to bypass your operating system completely and access the files on your hard driver directly (by booting a different operating system such as a rescue image or live CD, or anything, really).

Clearly the only thing that's going to help you there is to encrypt all your filesystems and your swap. You will have to enter a passphrase on the console at boot time. Without the passphrase, the filesystem can be destroyed, but not accessed.

Still, you should be aware that if the attacker has physical access, there are still some things that they could do (or might have already done!) such as installing a keylogger.

share|improve this answer
    
Absolutely; no matter how much you try to "second guess" an attacker with passwords for this and that, at the end of the day they can always pop your hard drive into another box and access your data. Encryption is the only way. –  IlluminAce Mar 17 '13 at 5:08

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.