He did this last time when I left my laptop at room. Opened the system recovery mode from advanced Ubuntu options and changed the password using 'passwd usrname ' command.Is there anything I can do for this to not happen in future.
-
1you can kill him. joking, possible duplicated of askubuntu.com/questions/303654/…– GeoAug 15, 2014 at 17:17
-
Heh. This is actually a cool trick. It works for Macs too. I have heard about setting root password, but that causes all sorts of problems in a system. ||| @Geo : Not a dupe at all. That is in regards to not allowing password-setting in Multiuser mode (booted). Root can override that restriction, so it wouldn't help here, nor is it a dupe.– Kaz WolfeAug 15, 2014 at 17:21
-
@Mew what problems does it cause?– muruAug 15, 2014 at 17:22
-
@muru Makes it easier to brute-force your system, adds challenges for you, makes hackers think what you're hiding, and causes a few SSH vulnerabilities. (Had a server). Sudo is much safer/easier, but it does allow this feature.– Kaz WolfeAug 15, 2014 at 17:25
-
@Mew What need to brute force if there is no password? SSH by default disallows password authentication for root. Adds only one challenge for the user: remember two passwords.– muruAug 15, 2014 at 17:27
2 Answers
For this user case probably the best "solution" is to re-install Ubuntu with full encryption (LUKS). This would secure the data and prevent changing the root/users password(s).
This could be defeated with a few methods, both hardware (key loggers) and software (custom kernels), but both of those options are unlikely. The OP can assess these risks.
With the above suggestion, I agree with the advice that the ultimate solution is to prevent physical access. In general physical access is root access via any number of techniques.
-
1
Yes. Set the root password. Open a terminal, and do:
sudo passwd
Enter a password. Then the root shell in recovery mode will always ask for this password.
Note that all this is futile as he can boot into a live USB and change your password.
Ultimately, given physical access, the security battle is lost.
-
1Block LiveCDs? goes into BIOS | Block BIOS? opens computer and gets HDD | Locked-In HDD? unlocks using lockpicking kit and screwdriver | Encrpyed HDD? cat \dev\null > \dev\sdb. Always a way to do SOMETHING with physical access. My HS tech guy and I would have wars over who could do the worst damage with only physical access. Aug 15, 2014 at 17:26
-
Also, you're forgetting about Hirens Boot CD. It has a tool to bypass passwords now. Aug 15, 2014 at 17:30
-
@Mew Doesn't prevent anyone from quickly removing the hard disk, attaching elsewhere and doing whatever they want. And adds yet another password for the user to remember. Let me repeat: physical access, the battle is lost. However, for low-grade fun like this roommate, setting a root password is enough, and simplest.– muruAug 15, 2014 at 17:30
-
I agree, setting a root password as muru advised is worthless and adds no significant additional security.– PantherAug 15, 2014 at 17:42
-
@bodhi.zazen I disagree, since this is enough to deter the casual prank. Anything more is a sledgehammer to kill an ant. While security is important, the context in which this security is setup is also important. Average users don't care. Otherwise we'd all be using full-disk encryption and BIOS passwords and unique passwords for everything, and encrypt all communication.– muruAug 15, 2014 at 17:46