17

I have passwords for my OS's but can someone actually harm my OS's, without loading them, just using the grub command prompt?

Is there a way to disable grub command prompt or maybe password protect them?

22

Yes they can; by editing GRUB to boot to single user mode.

They can then reset the root password simply by entering passwd. It is then possible to for the attacker to mount file systems and basically, do as they please...

This guide provides you with information on locking the GRUB command-prompt with a password: https://help.ubuntu.com/community/Grub2/Passwords

18

DevRobot's answer is the correct answer for the question being asked. I wanted to make you aware (if you weren't already) that grub is probably not what you should worry most about...

Physical access is total access (for the most part). Your OS passwords are meaningless if someone throws a flash drive in your computer and boots from it. They don't even need to change your root password - they have their own and can suddenly access all the files on your hard disk. If you're more worried about uptime and stability, then that same person could format your hard disk or make any changes whatsoever from the flash drive that you could do physically logged in.

The best value physical security is just to encrypt your hard disk. You won't notice a difference, but access without the disk password is essentially impossible.

  • An addendum to @blake's answer. Full disk encryption will usually make accessing data infeasible with physical access to a powered down machine. For a powered on machine, keys will be in RAM, and thus accessible to an attacker with the right resources. It certainly won't do anything to prevent almost all other forms of mischief someone with physical accesss can do. reformatting drives, installing firmware hosted keyloggers, just plain breaking things. lots of nasty and evil things can be done without access to the data stored on a disk. – Leliel Nov 26 '15 at 21:46
  • 2
    "You won't notice a difference" - Doesn't that depend on your hardware? On another not-to-be-named OS I've noticed a big difference when i turned on disk encryption. – xdhmoore Nov 27 '15 at 9:42
  • @xdhmoore Well, sure. If you're running hardware from the early 90s, you'll probably notice the performance hits of FDE. Personally, I've run Linux distros out of a LUKS container and OS X systems with FileVault 2, and I've never noticed a difference. – Blacklight Shining Nov 27 '15 at 21:18
  • I was using Bitlocker on Windows 7 on a Dell with a platter drive from 2012. Whenever I did a build on our project my Disk usage would max out. I moved to a Mac and with a solid state drive and it made a big difference. – xdhmoore Nov 27 '15 at 22:35
  • Yes, that difference is mostly because of the solid state drive. – peterrus Nov 28 '15 at 13:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.