Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite

I am running Ubuntu 12.10 on my laptop and I would like to make a set up such that without a login password, no one would be able to login into my system. Currently it seems that one can, quite easily, login into Ubuntu operating system using the recovery mode, or using an Ubuntu Live USB. When I realized that the system can be logged in so easily without a password, I wonder what's the purpose of the login password anyways !

Anyhow, how can I temporarily disable recovery mode and live USB boot? If there are other ways to get into USB, I would like to know them as well.

This is to prevent my roommate from getting access to my laptop when I go for vacation. So if some logging method requires a change of password before displaying my home directory, that's a less significant security risk for me, 'cause then I wont be able to login myself and will "detect" that someone has used my system (so your friend wont do that 'cause he knows you will find out and more importantly cannot login anymore).

Also I would like to password protect USB ports temporarily so that data cannot be copied out (or a keyloger cannot be copied in) without entering my root password.

Password-free entry is really a security flaw in Ubuntu in my opinion! You should backup your data regularly, and if you forget your password, too bad, you have to make a fresh installation !

Thanks

share|improve this question

2 Answers

up vote 7 down vote

Absolutely every operating system works like this. You might not have noticed it with Windows because Windows doesn't come with a rescue or live system, but that's a deficiency of Windows's administration tools. If you plug in a Windows drive on another Windows machine, you'll be able to read and modify the files. This is not under the control of the operating system, so there's no feature that you can disable to change that.

If you want to completely prevent access to your data, you have two choices: lock up the computer physically (put it in a locked room or in a safe), or encrypt your data.

This goes while the computer is powered off. If you leave the computer powered on, additional attacks are possible, for example by rebooting and accessing data still in RAM (which may include the encryption key) .

Ubuntu offers home directory encryption or full-disk encryption. For this use case, home directory encryption is enough: someone could still use your Linux installation but wouldn't be able to access your file. You can select home directory encryption at installation time or afterwards. Full-disk encryption can only be done at installation time, with the alternate CD.

Even if your data is encrypted, someone could erase it: they could wipe the disk, but then, they could also throw the disk into a furnace. If this is a concern, lock up the computer in a safe.

share|improve this answer
Thanks a lot for the information. I was just reading the man page for grub and apparently if you edit /etc/default/grub file and activate line RUB_DISABLE_RECOVERY="true", the recovery mode wont show up in boot. I did it and pressed ESC and left Shift keys, recovery mode is gone now. – eli Mar 17 at 0:16
I am also pretty sure that at University, we were once trying to get into a linux machine and there was absolutely no way to do it! When we tried Live USB boot or even a fresh installation the system would ask for admin password. How can I do this? – eli Mar 17 at 0:19
@eli Was that the BIOS asking for a password? That prevents booting the machine, but not accessing the disk on another machine. Only encryption can prevent accessing the disk on another machine. – Gilles Mar 17 at 0:20
I know about encryption, but with current technology, it's still not there yet. Imagine you download stuff and read write files etc and to encrypt all this in real time slows down the system. At least for laptops ! – eli Mar 17 at 0:22
@eli If the system is relatively current and the CPU supports AES-NI (and the Linux disk encryption mechanism, I'm not sure but imagine it does), then the overhead of full-disk encryption is very tiny, even with an SSD. It's not zero, but it's quite close to it... And that's without putting a significant load on the CPU. – Kitsune Mar 17 at 0:30
show 8 more comments
up vote 0 down vote

other simple thing you can do is put password on the bios and hard drive,( most laptops have this feature and isn't easy to bypass) so there is no chance to run a live cd or usb without entering the password before, hope this help

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.