This is in reference to a thread: http://www.linuxquestions.org/questi...d.php?t=544396

I would like to pose a scenario:
In a multiuser lab, no people should know the root password. Knowing the installed distribution, but not knowing the root password, would someone be able to utilize the install CD in rescue mode to change the password? This does not sound very good.

Sure they would, and on lots of distros there are even easier ways; like hitting "e" while the grub screen is displayed.

Surely at least one person should know the password.

As for the whole livecd thing .. have the computer *not* boot off the CD-ROM, and set up a BIOS password. And stuff like that. Physical security is not *that* hard to ensure given the user can not use a screwdriver.

Or, if you have the right type of case. password the BIOS, change the boot settings so that it can't boot from CD, then padlock the case shut. I did with mine. (Then lost the key... Duh.)

Reason for edit: Stoopid speling mistek!

In your scenario, the administrator would quickly become aware that the root password had been changed because her password would no longer work. In that circumstance, she would:

<edit>
First, change the BIOS so that HD boot precedes any other boot media, and protect BIOS changes with a password. This would prevent any such changes in the future. Of course, this should be done a a mater of course in any publicly accessible computer system. If there is a need to boot from some other media than the HD, she can use the BIOS password to change the setting for that boot, and then change it back.

She would also change the /etc/rc.d/rc[1-4].d/ setting so that changing the boot run level would not give root access without a password.

After that, she would:
</edit>

1) Boot into single user mode from a rescue disk
2) Create a new incremental backup to identify any changes since her last backup (see below)
3) Change the root password
4) Restore the system to a prior “known good” state from her backups
5) Start an internal investigation to identify who had made the unauthorized change, and what had been changed in the system
6) If the perpetrator could be identified, report the facts to the lab administrator for action
7) If the perpetrator could not be identified, report that to the lab administrator so a criminal investigation could be started.
8) Review the changes in the incremental backup and restore any authorized changes.

I think is just another myth. Did you try to boot in "single user mode" or in "rescue mode" with your distro install CD? I try many times in Slackware:
but finally was allways only
Or I miss the point?

The solution is simple:

Put your Linux server inside a locked closet where nobody can get physical access to it.

You can also password protect Grub and your BIOS. My last recommendation would be to disable root login on all consoles, but make sure at least one of your other accounts has root priviledge.

In your pose bit - why should no one know the root password in a multi user lab.

It is not a given that no one should know the root password, you should really explain what you are trying to achieve.

Assuming you want people to have access to their data restricted to themselves and not allow root (the admin) the ability to sniff around it - then you have to look towards encryption. So, you would encrypt part of the disk for each user.

Coming back to read my post, and all of your responses, I guess I left out information. Sorry about that.

1. I do realize at least one person should know the root password, but that should be the admin, not a general lab user.
2. I use BIOS passwords and boot orders at my job to keep users from attempting to boot from CD. I understand that aspect of security.

I think I should have thought it out more thoroughly before posting. This scenario just seems like such an easy way to bypass root, that it suprised me how easy it apparently is. With Windows, you have to pay mondo bucks for that type of security-breaking utility, generally much more than the average schmo wants to spend.

Not really, it's easy with windows too. You just need to get 2 files with a live cd, and there are tons of free utilities that can tell you the admin password. Alternatively, there are tons of exploits that give you admin privileges.

For Linux, if you already have a bios password, put in a grub password, and it's going to be pretty hard for the average user to get the root password (unless he has a screwdriver with him, and will reset the bios, or uses another hard drive as master, setting the one in the lab as slave, either way needing to open up the computer)

There is an ultimate way to protect a Linux root password which goes far beyond BIOS, Grub, and even external attempts: Encrypted File System. With newer version of the 2.6 kernel you can actually encrypt the root file system - in this way even if you do mount the hard disk externally you still cannot mount it unless you know the encrypted password. Just an FYI.