i want to know how to change the user name of my root account from root to xyz.
Also I want to know how to remove the option of boot into rescue mode from grub option at the boot time.
To secure your machine from unwanted root access we can disable the discovery root terminal in Grub2 by uncommenting the following line in
Note: To avoid security issues by editing GRUB2 entries while booting we may also want to restrict access to Grub boot menu by setting
GRUB_HIDDEN_TIMEOUT=0 and enabling the
OS_PROBER to prevent calling scripts in
To take effect we also want to run the following command:
This will not prevent booting into a root environment with a live CD.
Therefore we also need to disable CD-ROM, Network or USB booting features in BIOS. To prevent BIOS changes we also need a password for BIOS access, and a hardware lock for your case to prevent resetting BIOS on your motherboard.
In addition your harddisk may have to be encrypted in case your hardware gets stolen.
Warning: By securing your system in this way you may completely lock yourself out of your computer. Be careful what you do and proceed only if you know exactly what you do. Keep your passwords in a safe place.
Don't think the name of
root can be changed.
/etc/default/grub, uncomment (remove the '#' symbol) the following line:
NOT RECOMMENDED But if you really want to, use
sudo vipw and
sudo vipw -s to rename “root” in the
/etc/shadow files respectively. That’s all there is to it; to the kernel,
root is any user with UID 0 (at least that’s my novice understanding). Notice that if you do this,
sudo -i no longer works, but
sudo -u xyz -i does, and still drops you into a root prompt.
Physically lock the PC case so it can’t be opened.
Prevent the computer from booting other devices.
In the BIOS, edit the boot sequence so that it will only boot the hard drive (and not from CD, USB device, etc.). Then set a BIOS password to prevent someone from editing the boot sequence.
Disable the recovery mode option in Grub.
Edit the file
/etc/default/grub. Uncomment the line:
Add a Grub superuser. This has the side-effect of preventing unauthenticated Grub users from editing boot lines (like adding the
single parameter to boot into single-user mode and get root).
First, hash the password you want to use for the Grub superuser account:
Then add the superuser to the Grub config by appending the following lines to
/etc/grub.d/00_header (yes, include the
cat << EOF set superusers=[YOUR USERNAME] password_pbkdf2 [YOUR USERNAME] [YOUR grub.pbkdf2.sha512.10000.... PASSWORD STRING] EOF
(Example taken from http://www.g0hl1n.net/node/16.)
Finally, run the following to have the Grub configuration changes take effect:
What this does (assuming we have truly secured the BIOS and Grub) is reduce the attack surface to the physical security of the PC (i.e. break the case lock) and the security of Ubuntu when it’s online. The goal is to make it so someone can’t walk up to the PC, reboot it, go into single-user mode, give themselves root access, and then walk away — all in under a minute. Even if you are running full-disk encryption (yet still booting the kernel + initrd off of the PC hard drive), all these steps can still be a good idea, since it is trivial to perform the same attack in order to add a keylogger to the initrd that will sniff the encryption passphrase.