1

How can I prevent a Persistent or Full install on USB from accessing the computer's HDD?

If I log in as guest, I can not access the HDD, however there is no persistence between sessions. I would like to save between sessions.

If I create a "standard" user, the HDD can be accessed after supplying a password. I want no possibility of HDD access while booted from the flash drive.

I recall in previous versions of Ubuntu there was a drop down menu for User Privileges. I can not find it in 14.04 or later.

There is info on the internet about limiting access using permissions, but it seems awfully more complex than a drop down menu.

  • I think the guest session is limited by AppArmor, so maybe see if the AppArmor profile has something useful? – muru Jul 27 '17 at 0:58
  • 1
    Short answer you can not. – Panther Jul 27 '17 at 0:58
  • 1
    @muru - nothing prevents booting the usb to a root shell – Panther Jul 27 '17 at 1:03
  • 1
    @bodhi.zazen maybe, but then, why prevent the guest user from using su or sudo, or a number of other things? That excuse is a copout. There's protecting against intentional misuse and protecting against accidents. This could be useful for the latter. – muru Jul 27 '17 at 1:08
  • 2
    I don't mind if there is an option to log in as a user with administrative privileges as long as I can alternately log in as a user without privileges of accessing the HDD and causing accidents. – C.S.Cameron Jul 27 '17 at 1:20
3

Persistent live drive with a standard user, that cannot mount internal drives

I made a persistent live drive with mkusb from ubuntu-16.04.1-desktop-amd64.iso, which has the longest support of the present iso files.

A standard user ID (alongside the normal live system's user 'ubuntu') cannot run programs that need sudo: 'standard is not in the sudoers file. This incident will be reported.' Partitions on the internal drive are not mounted. To mount them, you need sudo permissions both for mount and udisksctl.

The persistent live system will boot into the ubuntu user, and you log out in order to switch to the standard user.

Encrypt home with users-admin

It is possible to create the standard user ID with encrypted home and login with a [good] password. This can be done easily, if the program users-admin is installed by activating the repository universe and installing the package gnome-system-tools.

sudo add-apt-repository universe
sudo apt update
sudo apt install gnome-system-tools

Tick the box according to the screenshot in order to create the new user with encrypted home.

tick the box

The computer should be shut down or rebooted after using the encrypted home. Otherwise the live user (or another user) gets access to encrypted data.

Persistent live drive with a standard user and a user with administration permissions

I made a persistent live drive with mkusb from ubuntu-16.04.2-desktop-amd64.iso, which is a newer LTS iso file, in order to test that these tasks work with more than one iso file.

In some computers, the system may leave you with a black screen after logging in (after a logout). This might depend on the graphics driver. If it happens, you can do something with the mouse or keyboard to get to the desktop. If still no luck you can enter a text screen and then return to the graphics screen with the hotkey combinations

ctrl + alt + F1

ctrl + alt + F7

It is possible to create another user ID with administration permissions, that can manage system tasks, for example install and upgrade program packages (if you want to separate the tasks because of security reasons). One (or both) user ID(s) can be made with encrypted home if you wish.

With these two user IDs it will be possible to remove the live system's normal user 'ubuntu'. You can do it from the user ID with administration permissions after killing the processes that are running with the user 'ubuntu'

ps -Af | grep ubuntu  # identify which processes to kill
sudo kill <the PID numbers that you found (without any brackets)>

sudo deluser ubuntu

After that you can also remove the content in the 'casper-rw' partition (or file) concerning the deleted user (if you wish), but there is probably not much data, so not very important unless you suspect there is some confidential data.

Now after removing the live system's normal user 'ubuntu', the persistent live system will boot to the login screen, and you can select which user ID to log in to, the standard user or the user with administration permissions. I like this behaviour, and I think it is worth the extra effort (compared to a system with a standard user alongside the normal live system's user 'ubuntu').

Backup is important

Frequent backup is important, because it is a

  • persistent live system (makes it sensitive)

  • an encrypted system (makes it difficult to repair/recover).

See this link: Backup and restore of persistent overlay data

Security - turn off swapping

If this kind of system finds a swap partition in the internal drive, it will probably use it, and might leave traces that are not encrypted. So please turn off swapping if there is a linux swap partition in an internal drive in the computer, where you are running the system.

You must log in or 'su' into the user ID with administration permissions, 'guru', to turn off swapping

su - guru
/sbin/swapon -s  # check
sudo /sbin/swapoff -a
/sbin/swapon -s  # check
exit

Comparing to an installed system

Comparing this kind of persistent live system to an installed system (in a USB pendrive in both cases),

Advantage:

  • more portable (than an installed system).

Disadvantages:

  • less stable (than an installed system).

  • less secure (encrypted home is less secure than encrypted disk, which is possible with an installed system). But it might be secure enough.

|improve this answer|||||
1

As has been mentioned, there's no real security without physical control of the machine, but just looking at standard users, and limiting access to the disk, that's the default. Unless you put an entry into /etc/fstab to allow regular users to mount a partition, they cannot mount it.

What you say confuses me a bit, but sudo access can be through sudo group or the "admin" group ( no longer exists after 11.10 but still in the sudoers file). Apparently "admin" is not the systems groups listed in /etc/adduser.conf). Since the "ubuntu" entry is in /etc/sudoers.d/casper file, that gives ubuntu the sudo capability.

I booted a a (persistent) mkusb USB media, created a user, and that user could not mount my hard disk, nor did it have any sudo capability.


So the problem is that the default user "ubuntu" does not have a password, and has sudo capability (directly from /etc/sudoers.d/casper) -- making sudo capability available to anyone, because they can switch to the ubuntu user. This being a live media, some things will not work like on a full install, but since you have another sudo user, try in order:

  1. Remove the /etc/sudoers.d/casper file. That removes ubuntu from sudo access.

  2. Put a password on the ubuntu user. May be sufficient by itself, but there is a big "NOPASSWORD" stuck in the /etc/sudoers.d/casper file which may also need changing.

  3. Remove the ubuntu user completly.

|improve this answer|||||
  • "sudo access can be through the "admin" groups (100-999)" How? What makes you think that? – muru Jul 27 '17 at 3:28
  • 1
    @C.S.Cameron, It is possible to create the standard user with encrypted home and login with a [good] password. This can be done easily, if the program users-admin is installed by activating the repository universe and installing the package gnome-system-tools. -- The computer should be shut down or rebooted after using the encrypted home. Otherwise the live user has access to encrypted data. – sudodus Jul 27 '17 at 9:04
  • 1
    @ubfan1/sudodus: I added Admin user "cscameron" and standard user "cork" to a mkusb persistent install. Booting as "cork" I get "Authentication is required ..." when trying to open the HDD, the drop down offers a choice between "cscameron" and ubuntu, not "cork". choosing Ubuntu mounts the disk with a blank password. With a Full install flash drive and the same users I get "Authentication is required ..." window with a request for cscameron's password. I agree that a standard user can not run sudo, but my standard user has no problem accessing the HDD anyway. – C.S.Cameron Jul 27 '17 at 17:27
  • 1
    @C.S.Cameron, Yes, but if you choose another user, at least you are aware, that you have to do something special and potentially dangerous. After all, you can boot live-only and get access anyway: muru: "There's protecting against intentional misuse and protecting against accidents. This could be useful for the latter". Things get slightly safer if you delete the standard live user ubuntu, because then you need the password of the admin user to use sudo. – sudodus Jul 27 '17 at 18:59
  • 1
    @sudodus: users-admin was the drop down menu that I mentioned in the question, it used to come with 10.04, thank you. How to use this to encrypt home? – C.S.Cameron Jul 27 '17 at 23:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.