Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I remove the ability to reset passwords outside of Ubuntu. This probably is ill advised, but I already have set a really good password that I cannot forget with high entropy and 42 characters. I think that it is great that Ubuntu can so easily reset a password, but it seems like a big security risk. (I know you can edit grub, but anyone that knows anything about Linux will just edit the boot command and boot into recovery anyway.) Thanks in advance.

share|improve this question
up vote 0 down vote accepted

Disable the recovery mode by uncommenting the line:


in /etc/default/grub (and running sudo update-grub afterwards), and password protect grub menu entry.

share|improve this answer
Yeah, that is what I was talking about, though. Can't someone just use a live cd and change that back? – user175999 Jul 17 '13 at 14:17
@user175999 I think I understand your concerns now. You can also passowrd protect the grub menu (answer updated). But there's no definitive solution. Physical access + knowledge = anything is possible. Unless you encrypt your hard disk. – Eric Carvalho Jul 17 '13 at 14:38
Even with encrypting with luks, don't most of the necessary files still have to be left unencrypted. i.e. the grub settings and unencrypted /boot? – user175999 Jul 17 '13 at 14:41
@user175999 With LUKS , /boot is NOT encrypted. In theory someone could alter or install a custom kernel into /boot, but, they could not change your log in password. I agree with Eric, if someone has physical access you will have a problem. You can look at Truecyrpt or you can put /boot on a flash drive. – bodhi.zazen Jul 17 '13 at 17:12
Yeah I think I'm going to go with TrueCrypt. I think it is going to be better and easier than messing with LUKS. Thank you all. – user175999 Jul 17 '13 at 17:16

The only way to be sure is to encrypt the disk. Short of that, you have to physically secure the machine so that someone can not remove the HD and plug it into another machine or boot the machine from removable media. Only then does locking down grub do any good.

share|improve this answer
Do you suggest luks or some other way? I guess a Bios Password I suppose as well? – user175999 Jul 17 '13 at 16:20
Bios password can (depending on the bios) easily be defeated. +1 to LUKS. – bodhi.zazen Jul 17 '13 at 17:13
@bodhi.zazen, only when you have physical access to open the machine and short the reset jumper, hence the caveat about physical security. – psusi Jul 17 '13 at 18:11

The best way to protect your installation is to apply all the above fixes and lock the PC into a box with ventilation in a room that only you have a key to.

share|improve this answer
Sarcastic answers are not appreciated. Sarcasm is best kept to comments. If you lack the reputation needed to comment, then try asking/answering some questions with good quality. – Daniel Mar 7 at 21:27

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.