Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm taking steps to secure my laptop - from both a data security and physical security point of view.

I currently have full disk encryption with LUKS set up through the installer - this is pretty much a vanilla configuration as per installer defaults, with an unencrypted boot partition that asks me to unlock the disk.

In the case of my laptop being stolen, I don't have anything set up at the moment that would help me/the police recover it. For this reason, I want to configure a honey-trap that will allow the laptop to run Prey if a thief boots the laptop.

To do this, I want to move the standard GRUB, kernel and inital ramdisk onto a USB stick that I'll keep with me at all times. I'll install a copy of Tiny Core Linux (Or dare I say - Windows) on my laptop which will only boot when I don't plug in my USB stick.

To stop a potential thief from wiping the hard drive, I'm going to apply a BIOS password and disable booting from external devices. Obviously this wouldn't stop them removing the HDD and wiping it, but it's a step against a low-level thief.

If I do this, I won't be able to boot from my USB - so I'll need a way to chainload GRUB on my USB from GRUB on my hard drive.

Is this possible - if so, how can I do this/where can I find suitable documentation? Everywhere I've looked suggests using PLoP, LILO or some other software, when I'm sure this should be possible from GRUB alone.

Similarly, I could use UEFI Secure Boot to restrict booting onto only my honey trap and "true" kernels and initial ramdisks, but my laptop isn't UEFI-compatible :(

Similarly this could be an X/Y problem, so if you think I'm going about this the wrong way, feel free to suggest changes.

share|improve this question
Since both physical and data security are paramount, and I assume you cannot physically remove the entire laptop to a secure locked location it might be easier to create a bootable usb stick and remove the hard drive to keep with you. This would provide access to the laptop to others and protect your data. Another option is boot from network with HD removed. – pfeiffep Mar 28 '13 at 14:07

I think that you can try to mount the /boot partition on the usb key, but let the boot loader in the internal drive MBR. I am pretty sure that you can configure something like that with the Ubuntu installer: it is possible to mount nearly any point to any partition, and to choose in wich drive is written the MBR.

This way, the Bios would find the MBR on the internal drive, so you can disable external drive boot.

Here is the link to the complete doc about Grub 2: Maybe you should have a look at it and check if you can make a Grub script to check if your usb key is available. If it is, it would start your main system entry in Grub Menu as default. If not, it would start the entry with "Tiny Core Linux" and "Prey".

Also, you should go in #grub on the Freenode IRC.

share|improve this answer
It's possible to put /boot on a separate disk to the internal hard drive, but that's only half of what I want to do. I want to boot off the internal drive, then if usb is plugged in boot from that, otherwise boot from the hdd image with prey installed. As for the "reference to the usb key" - I presume I'd be able to use the UUID of the partition on the usb stick. – jackweirdy Mar 25 '13 at 17:00
Could you please rewrite a bit you question in order to make it more clear? Because at this point, I am not sure anyone can really understand what you want to achieve... – ttoine Mar 25 '13 at 17:30
Rephrased. I hope that's better :) – jackweirdy Mar 25 '13 at 17:38
imho, if Grub can check that the usb key is here, you're done. – ttoine Mar 26 '13 at 9:19
That's what I'm looking for :D – jackweirdy Mar 26 '13 at 11:09

GRUB treats USB drives like other hard disks. I've had success booting kernels/installations on USB sticks from a grub installed to the MBR of an internal drive, by using something like:
root (hd1,0)
(To boot off the first partition of the second hard disk.)
That does assume consistent arrangement of drives. It is probably also possible to specify a partition by UUID - as ttoine said, check them man pages.

You can test at boot-up, by using c at the GRUB menu to access the GRUB command line (or edit an existing entry). Then (start up and) set up your config file with USB-boot as default, and presto.

(Just re-read that - yes, you can have GRUB load a new cfg from the usb stick, rather than a kernel.)

FWIW, I wouldn't expect much help from the police most places, even if you have the location of your machine. You might want to keep your /home/ on the USB; if not, at least back it up frequently.

share|improve this answer
maybe moving /home/ to the drive would be the most secure way of doing this. you are right.# – LittleByBlue May 12 at 9:34

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.