LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Ubuntu (https://www.linuxquestions.org/questions/ubuntu-63/)
-   -   Security Question (https://www.linuxquestions.org/questions/ubuntu-63/security-question-537148/)

vasco-t 03-13-2007 02:10 PM
Security Question
 
After installing Ubuntu then leaving it for a few days I forgot my base user password. So, looking through the forums I came across a way to reser my password by booting in the "Recovery Mode" of GRUB then using the passwd command.

This worked fine but I then thought that if I install UBUNTU on workstations for non-priviledged users thew will also find it easy to change the base password and gain privileged access to the system.

Is there a recognised method of preventing this?

Thanks

bulliver 03-13-2007 09:37 PM
Quote:
Is there a recognised method of preventing this?
You can also set a 'grub' password, to dissallow mucking about.
Also consider setting a CMOS (BIOS) password.

aysiu 03-13-2007 11:41 PM
Quote:
Originally Posted by vasco-t
This worked fine but I then thought that if I install UBUNTU on workstations for non-priviledged users thew will also find it easy to change the base password and gain privileged access to the system.

Is there a recognised method of preventing this?
Yes, remove the Grub entry or establish a root password and prevent physical access to the workstation.

Read more here:
http://psychocats.net/ubuntu/security#recoveryrisk

vasco-t 03-14-2007 06:46 AM
Thanks for your replies/suggestions.

Putting a password on the CMOS/BIOS would, of course, limit workstation access but in this case the workstation will be used as a general Internet access station by many users so the BIOS password would be distributed.

I edited the /boot/grub/menu.lst file to include the command:
password topsecret
(as in the example) but I found that I could still select recovery mode from the grub menu. Maybe I have interpreted it wrong but I thought that this command limited access to the grub menu.

Any ideas?
Thanks

bulliver 03-14-2007 01:05 PM
Quote:
Maybe I have interpreted it wrong but I thought that this command limited access to the grub menu.
Sorry Vasco, I thought it would too. Kind of pointless otherwise...

Wait, from "info grub":
Code:
password [`--md5'] passwd [new-config-file]
      If used in the first section of a menu file, disable all
      interactive editing control (menu entry editor and command-line)
      and entries protected by the command `lock'.
So, you just have to 'lock' the entries.

HTH

vasco-t 03-15-2007 05:06 AM
Many thanks.
After a few tries I got it working.
It seems that I needed to insert the command lock after every line that started with title.

Although, reading the notes in menu.lst it seems that a Debian Update will overwrite my lock command.

Cheers


All times are GMT -5. The time now is 04:15 AM.