Recently one of my friends came over to my place, within 15 minutes he hacked my account using a Live CD and reset the password in front of me. I was baffled to see such a thing. Please guide me to prevent such a future attempt using a Live CD.
A quick and easy way to do this is to disable booting from CDs and USB sticks in your BIOS and set a BIOS password.
According to this wiki page:
However there's nothing stopping someone from just stealing your hard drive and mounting it on another machine, or resetting your BIOS by removing the battery, or one of the other methods that an attacker can use when they have physical access to your machine.
A better way would be to encrypt your drive, you can either do this by encrypting your home directory, or encrypting the entire disk:
Stand next to your computer while holding a tee-ball bat. Severely beat anyone who gets close.
Or lock it up.
If your computer is physically accessible, it is unsafe.
First the warning...
The grub2 password protection procedure can be quite tricky and if you get it wrong there is a possibility of leaving yourself with a non-bootable system. Thus always make a full image backup of your hard-drive first. My recommendation would be to use Clonezilla - another backup tool such as PartImage could also be used.
If you want to practice this - use a virtual machine guest which you can rollback a snapshot.
The procedure below protects unauthorised editing of Grub settings whilst booting - that is, pressing e to edit allows you to change the boot options. You could for example, force booting to single user mode and thus have access to your hard-disk.
This procedure should be used in conjunction with hard-disk encryption and a secure bios boot option to prevent booting from live cd as described in the associated answer to this question.
almost everything below can be copied and pasted one line at a time.
First lets backup the grub files we will be editing - open a terminal session:
Lets create a username for grub:
Scroll to the bottom, add a new empty line and copy and paste the following:
In this example two usernames were created: myusername and recovery
Next - navigate back to the terminal (don't close
Natty and Oneiric users only
Generate an encrypted password by typing
Enter your password you will use twice when prompted
The bit we are interested in starts
Highlight this section using your mouse, right click and copy this.
Switch back to your
i.e. the line should look like
all 'buntu versions (lucid and above)
Save and close the file.
Finally you need to password protect each grub menu entry (all files that have a line that begins menuentry):
This will add a new entry
Run update-grub to regenerate your grub
When you try to edit a grub entry it will ask for your user name i.e. myusername and the password you used.
Reboot and test that username and password is being enforced when editing all of the grub-entries.
N.B. remember to press SHIFT during boot to display your grub.
All of the above can easily be workaround by using recovery mode.
Fortunately you can also force a username and password to use the recovery-mode menu entry. In the first part of this answer we create an additional username called recovery with a password of 1234. To use this username we need to edit the following file:
change the line from:
When using recovery use the username recovery and the password 1234
Reboot and test that you are asked for as username and password when trying to boot into recovery mode.
More Information - http://ubuntuforums.org/showthread.php?t=1369019
It's important to remember that if someone has physical access to your machine, they will always be able to do things to your PC. Things like locking your PC case and BIOS passwords won't stop a determined person from taking your hard drive and data anyway.
You can make it so that even in a case of resetting, the "resetter" wont be able to see the data.
To do this, just encrypt
If you want to make it so that resetting isn't possible, something needs to be removed, which is in charge of changing the password.