1

How can I remove the ability to reset passwords outside of Ubuntu. This probably is ill advised, but I already have set a really good password that I cannot forget with high entropy and 42 characters. I think that it is great that Ubuntu can so easily reset a password, but it seems like a big security risk. (I know you can edit grub, but anyone that knows anything about Linux will just edit the boot command and boot into recovery anyway.) Thanks in advance.

3 Answers 3

2

Disable the recovery mode by uncommenting the line:

#GRUB_DISABLE_RECOVERY="true"

in /etc/default/grub (and running sudo update-grub afterwards), and password protect grub menu entry.

7
  • Yeah, that is what I was talking about, though. Can't someone just use a live cd and change that back?
    – user175999
    Jul 17, 2013 at 14:17
  • 1
    @user175999 I think I understand your concerns now. You can also passowrd protect the grub menu (answer updated). But there's no definitive solution. Physical access + knowledge = anything is possible. Unless you encrypt your hard disk. Jul 17, 2013 at 14:38
  • Even with encrypting with luks, don't most of the necessary files still have to be left unencrypted. i.e. the grub settings and unencrypted /boot?
    – user175999
    Jul 17, 2013 at 14:41
  • @user175999 With LUKS , /boot is NOT encrypted. In theory someone could alter or install a custom kernel into /boot, but, they could not change your log in password. I agree with Eric, if someone has physical access you will have a problem. You can look at Truecyrpt or you can put /boot on a flash drive.
    – Panther
    Jul 17, 2013 at 17:12
  • 1
    In order to prevent booting from a live CD/DVD or USB, you can password protect your BIOS and not allow booting from such devices. Oct 4, 2017 at 15:51
1

The only way to be sure is to encrypt the disk. Short of that, you have to physically secure the machine so that someone can not remove the HD and plug it into another machine or boot the machine from removable media. Only then does locking down grub do any good.

3
  • Do you suggest luks or some other way? I guess a Bios Password I suppose as well?
    – user175999
    Jul 17, 2013 at 16:20
  • Bios password can (depending on the bios) easily be defeated. +1 to LUKS.
    – Panther
    Jul 17, 2013 at 17:13
  • @bodhi.zazen, only when you have physical access to open the machine and short the reset jumper, hence the caveat about physical security.
    – psusi
    Jul 17, 2013 at 18:11
-1

The best way to protect your installation is to apply all the above fixes and lock the PC into a box with ventilation in a room that only you have a key to.

1
  • Sarcastic answers are not appreciated. Sarcasm is best kept to comments. If you lack the reputation needed to comment, then try asking/answering some questions with good quality.
    – Daniel
    Mar 7, 2016 at 21:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .