Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

When I boot system in to recovery mode from GRUB menu, I can get in to all powerful root without entering any password, thus insecure.

How I can secure this and ensure that a password is asked every time I attempt to access root in recovery mode?

share|improve this question
    
Do you need anymore clarifications? –  Erik Johansson Mar 27 '11 at 20:45
add comment

2 Answers

up vote 3 down vote accepted

There is a post on Ubuntu forums about protecting entries by password, basically to make the recovery menuitems require you to login as superman with password 1234 you need to edit some very hairy config/script files:

Add to /etc/grub.d/00_header

cat << EOF
set superusers="superman"
password superman 1234
password bill 5678
EOF 

Change /etc/grub.d/10_linux

From:

printf "menuentry '${title}' ${CLASS} {\n" "${os}" "${version}"

To:

if ${recovery} ; then
   printf "menuentry '${title}' --users superman ${CLASS} {\n" "${os}" "${version}"
else
   printf "menuentry '${title}' ${CLASS} {\n" "${os}" "${version}"
fi 

Perfecting protection is profoundly hard

Other things you need to do is to password protect your bios, disable booting from anything else than primary hard drive, and encrypt your root partition and mount any other partition as noexec. This still leaves lots of vectors.

share|improve this answer
    
That looks promising. Will check that. –  Jamess Mar 23 '11 at 11:25
add comment

The only reliable way to protect the system from an attacker having physical access to the machine is full-disk encryption.

share|improve this answer
    
Or locking down the BIOS –  Reuben Swartz Mar 24 '11 at 0:03
    
It's trivial to reset the BIOS password once you have access to the hardware. However, a disk encrypted with a good passphrase (immune to a dictionary attack) will remain secure as long as AES is secure. –  Adam Byrtek Mar 24 '11 at 8:35
    
Not really easy because you will often need tools and another computer to do it. –  Erik Johansson Mar 24 '11 at 21:59
    
It all depends on a threat model. –  Adam Byrtek Mar 24 '11 at 23:03
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.