Security Question

vasco-t · 03-13-2007, 02:10 PM

After installing Ubuntu then leaving it for a few days I forgot my base user password. So, looking through the forums I came across a way to reser my password by booting in the "Recovery Mode" of GRUB then using the passwd command.

This worked fine but I then thought that if I install UBUNTU on workstations for non-priviledged users thew will also find it easy to change the base password and gain privileged access to the system.

Is there a recognised method of preventing this?

Thanks

bulliver · 03-13-2007, 09:37 PM

Quote:

Is there a recognised method of preventing this?

You can also set a 'grub' password, to dissallow mucking about.
Also consider setting a CMOS (BIOS) password.

aysiu · 03-13-2007, 11:41 PM

Quote:

Originally Posted by vasco-t

This worked fine but I then thought that if I install UBUNTU on workstations for non-priviledged users thew will also find it easy to change the base password and gain privileged access to the system.

Is there a recognised method of preventing this?

Yes, remove the Grub entry or establish a root password and prevent physical access to the workstation.

Read more here:
http://psychocats.net/ubuntu/security#recoveryrisk

vasco-t · 03-14-2007, 06:46 AM

Thanks for your replies/suggestions.

Putting a password on the CMOS/BIOS would, of course, limit workstation access but in this case the workstation will be used as a general Internet access station by many users so the BIOS password would be distributed.

I edited the /boot/grub/menu.lst file to include the command:
password topsecret
(as in the example) but I found that I could still select recovery mode from the grub menu. Maybe I have interpreted it wrong but I thought that this command limited access to the grub menu.

Any ideas?
Thanks

bulliver · 03-14-2007, 01:05 PM

Quote:

Maybe I have interpreted it wrong but I thought that this command limited access to the grub menu.

Sorry Vasco, I thought it would too. Kind of pointless otherwise...

Wait, from "info grub":

Code:

password [`--md5'] passwd [new-config-file]
      If used in the first section of a menu file, disable all
      interactive editing control (menu entry editor and command-line)
      and entries protected by the command `lock'.

So, you just have to 'lock' the entries.

HTH

vasco-t · 03-15-2007, 05:06 AM

Many thanks.
After a few tries I got it working.
It seems that I needed to insert the command lock after every line that started with title.

Although, reading the notes in menu.lst it seems that a Debian Update will overwrite my lock command.

Cheers