Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

We use a small computer with linux attached to a big tv to display some data to the public. Normally, there is no keyboard connected. When a keyboard is connected at boot, we start the configuration screens. A browser displayed in full screen after boot.

I protected the BIOS with password.

How can I avoid that someone connects in single user mode to access to files.

Is there other things that I can do to protect against hack ?

Thanks in advance

share|improve this question
Rule of the thumb: If you can physically touch a device, you own it. If anyone can physically reach the box, they can pretty much do whatever they want. – Luc Dec 7 '12 at 14:40

3 Answers

up vote 1 down vote accepted

Option 1: try to restrict access

In addition to setting a BIOS password...

Set a password for grub (this prevents changing of the stored boot command lines, but tere are still ways around this)

Require the root password for access in single-user mode.

Restrict physical access to the box and it's ports.

Option 2: make the controlled content unavailable at boot time

Keep all the sensitive content in an encrypted filesystem with a manually entered passphrase. Add an unmount script for the filesystem to the runlevel scripts.

Obviously Option 2 does not provide for protection against malware installed on the system after you come along and mount the encrypted filesystem - hence you should use both approaches.

share|improve this answer
up vote 1 down vote

You could always utilize a USB port blocker to physically block access to any USB ports. You only really need one of these per device... the other USB ports can be dealt with super glue (or most likely a different non-permanent solution).

share|improve this answer
up vote 0 down vote

You need to protect the system to prevent physical access, otherwise anyone with a USB keyboard can gain control of your system.

There are a couple of options you could explore if you are willing to require that someone be present every time the system need to be booted:

  • Bios password/boot password: you could set a boot password to prevent unauthorized users from booting the system
  • Key based encryption: you could require a USB key be inserted to boot and decrypt the system

As I said, these will prevent unauthorized use but the system can't reboot on its own, someone would have to go there.

share|improve this answer
Thoses screens are installed on site. They have physical access to them... Do you have other ideas to prevent abuses ? Thanks ! – si2w Dec 6 '12 at 19:58
When GdD says "prevent physical access", it most likely means to keep the box enclosed in a locked cabinet, or in a separate room. The screen is an unlikely attack point; you should concentrate on protecting the computer itself. – Jonathan Garber Dec 6 '12 at 20:15
That's exactly what I meant, thanks @JonathanGarber – GdD Dec 7 '12 at 9:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.