10

I have a fully encrypted drive so I know when my laptop is turned off that nobody can access my data but what about when the screen is locked with my root password?

It is often impractical to turn off my computer everytime I leave my laptop unattended and as all my data is backed up and the laptop is pretty cheap, I'm not too bothered if it gets stolen as long as I know my data is secure.

I know there is a hack to bypass log-in or reset the root password on an unencrypted drive but this requires a reboot so it wouldn't be an issue for me as the crypt password is needed before any root password and my crypt password is likely much more complex than most people's. It took me a long time to memorize it.

My root password is secure but less secure than the encryption password as it would be too impractical to type something too long each time I want sudo or to unlock the screen.

If somebody steals my laptop when it is locked but turned on and then plugs it into a power source so the battery does not die, would it be easy for them to get access assuming they had plenty of time?

Other than trying to brute force my password is there any other way they could get into my computer as long as it remains turned on? When I enter the wrong log-in password the system says "checking" for a couple of seconds even though it already knows the password it wrong but I can see this is a delay to prevent rapid brute force guesses. I'm not worried about a dictionary attack as this would take years with that delay.

Sorry if this question has been answered but I can't find any conclusive answer.

I need to make a run to the store now for some supplies. I want to leave my downloads running with a locked screen. Should I be worried about a burglar stealing my laptop while I'm gone and reading my embarrassing browsing history?

edit:

TL;DR

If I leave my laptop on and the screen is locked can someone get access if they steal my computer? My drive is encrypted in-case they reboot.

  • 1
    With enough time and physical access to the hardware, a determined enough person can break through any security measure. Nothing says they can't rent a couple thousand exaFLOPS of crunching power from Google or somebody and brute-force your encryption. – Android Dev Apr 11 '16 at 23:05
  • 2
    Unlike the old gnome screensaver, the new unity lockscreen is an unkillable process - I've tested that. Now, by default there's no ban feature. But if i recall correctly, there is a way to set a lock on account after 3 failed attempts. That's should help with brute force attacks – Sergiy Kolodyazhnyy Apr 11 '16 at 23:21
  • Does your encrypted drive really powercycle on a reboot? Mine doesn't, and it would easily be possible to reboot it, boot an OS on a stick and copy all the (transparently decrypted) data. Or do you use software encryption? I assumed you are using a self encrypting drive since you said your "disk is fully encrypted" – Gasp0de Jan 10 '18 at 15:59
1

They could try to brute-force your password, you might want to set it up so accounts are locked out after too many failed attempts. You didn't ask how, but if you're interested you can read more here http://blog.bodhizazen.com/linux/ubuntu-how-to-faillog/)

Edit : including steps as requested

Open /etc/pam.d/common-auth and add the line AT THE TOP OF THE FILE:

auth required pam_tally.so per_user magic_root onerr=fail

To set the number of attempts allowed & timeout

faillog -m 3 -l 3600

Where 3 is the number of attempts allowed and 3600 seconds (1 hour) is how long to lock out the account for.

You can omit the -l part and the account will be locked out forever, however I would really not recommend that since your hard drive is encrypted. It would make your files very difficult to recover if you locked yourself out. If you choose to omit the lockout time, I would at least increase the number of attempts, because it's not that difficult to enter your password wrong 3 times.

  • You still could provide the steps here, links and their content can change or vanish altogether and then your answer wouldn't be much more as a comment and a dead end. – Videonauth May 22 '16 at 4:34
  • This answer did not work for me in lubuntu 16.04. This did work:auth required pam_tally2.so file=/var/log/tallylog deny=3 even_deny_root unlock_time=1200. I took it from the answer by "slm" on unix.stackexchange.com/questions/78182/…. It also explains it very well. – Sruli Feb 8 '17 at 13:19
1

Any way? Yes, look up the liquid nitrogen RAM attacks. It's always a question of how secure you want to be, not being undefeatable. If an attacker needs a dewer of LN on hand to defeat you, you're fairly likely to see him coming.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.