Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

How can I remove the ability to reset passwords outside of Ubuntu. This probably is ill advised, but I already have set a really good password that I cannot forget with high entropy and 42 characters. I think that it is great that Ubuntu can so easily reset a password, but it seems like a big security risk. (I know you can edit grub, but anyone that knows anything about Linux will just edit the boot command and boot into recovery anyway.) Thanks in advance.

share|improve this question
add comment

2 Answers

up vote 0 down vote accepted

Disable the recovery mode by uncommenting the line:

#GRUB_DISABLE_RECOVERY="true"

in /etc/default/grub (and running sudo update-grub afterwards), and password protect grub menu entry.

share|improve this answer
    
Yeah, that is what I was talking about, though. Can't someone just use a live cd and change that back? –  user175999 Jul 17 '13 at 14:17
1  
@user175999 I think I understand your concerns now. You can also passowrd protect the grub menu (answer updated). But there's no definitive solution. Physical access + knowledge = anything is possible. Unless you encrypt your hard disk. –  Eric Carvalho Jul 17 '13 at 14:38
    
Even with encrypting with luks, don't most of the necessary files still have to be left unencrypted. i.e. the grub settings and unencrypted /boot? –  user175999 Jul 17 '13 at 14:41
    
@user175999 I don't know about LUKS, but I do know TrueCrypt supports pre-boot authentication, so you'll end up with encrypted grub and /boot. –  Eric Carvalho Jul 17 '13 at 16:28
    
@user175999 With LUKS , /boot is NOT encrypted. In theory someone could alter or install a custom kernel into /boot, but, they could not change your log in password. I agree with Eric, if someone has physical access you will have a problem. You can look at Truecyrpt or you can put /boot on a flash drive. –  bodhi.zazen Jul 17 '13 at 17:12
show 2 more comments

The only way to be sure is to encrypt the disk. Short of that, you have to physically secure the machine so that someone can not remove the HD and plug it into another machine or boot the machine from removable media. Only then does locking down grub do any good.

share|improve this answer
    
Do you suggest luks or some other way? I guess a Bios Password I suppose as well? –  user175999 Jul 17 '13 at 16:20
    
Bios password can (depending on the bios) easily be defeated. +1 to LUKS. –  bodhi.zazen Jul 17 '13 at 17:13
    
@bodhi.zazen, only when you have physical access to open the machine and short the reset jumper, hence the caveat about physical security. –  psusi Jul 17 '13 at 18:11
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.