Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am running Ubuntu 12.10 on my laptop and I would like to make a set up such that without a login password, no one would be able to login into my system. Currently it seems that one can, quite easily, login into Ubuntu operating system using the recovery mode, or using an Ubuntu Live USB. When I realized that the system can be logged in so easily without a password, I wonder what's the purpose of the login password anyways !

Anyhow, how can I temporarily disable recovery mode and live USB boot? If there are other ways to get into USB, I would like to know them as well.

This is to prevent my roommate from getting access to my laptop when I go for vacation. So if some logging method requires a change of password before displaying my home directory, that's a less significant security risk for me, 'cause then I wont be able to login myself and will "detect" that someone has used my system (so your friend wont do that 'cause he knows you will find out and more importantly cannot login anymore).

Also I would like to password protect USB ports temporarily so that data cannot be copied out (or a keyloger cannot be copied in) without entering my root password.

Password-free entry is really a security flaw in Ubuntu in my opinion! You should backup your data regularly, and if you forget your password, too bad, you have to make a fresh installation !

Thanks

share|improve this question

2 Answers 2

Absolutely every operating system works like this. You might not have noticed it with Windows because Windows doesn't come with a rescue or live system, but that's a deficiency of Windows's administration tools. If you plug in a Windows drive on another Windows machine, you'll be able to read and modify the files. This is not under the control of the operating system, so there's no feature that you can disable to change that.

You can prevent the computer from booting from rescue media, by restricting boot choices in the BIOS and setting a password (again, in the BIOS, not in the operating system) to change BIOS settings or boot from alternate media, and by disabling or password-protecting access to the boot prompt in the Grub settings. But that won't protect from someone taking the disk out and plugging it into another machine. In your scenario, changing BIOS or Grub settings is useless.

If you want to completely prevent access to your data, you have two choices: lock up the computer physically (put it in a locked room or in a safe), or encrypt your data.

This goes while the computer is powered off. If you leave the computer powered on, additional attacks are possible, for example by rebooting and accessing data still in RAM (which may include the encryption key).

Preventing access to USB ports wouldn't be useful: anyone who can plug something into your laptop's USB port can also take the disk out and plug it into their own machine. “Password protect USB ports” only makes sense within the context of an operating system, but all the attacks we're discussing here are outside the context of the operating system.

Ubuntu offers home directory encryption or full-disk encryption. For this use case, home directory encryption is enough: someone could still use your Linux installation but wouldn't be able to access your files. You can select home directory encryption at installation time or afterwards. Full-disk encryption can only be done at installation time, with the alternate CD.

Even if your data is encrypted, someone could erase it: they could wipe the disk, but then, they could also throw the disk into a furnace. If this is a concern, lock up the computer in a safe.

share|improve this answer
    
Thanks a lot for the information. I was just reading the man page for grub and apparently if you edit /etc/default/grub file and activate line RUB_DISABLE_RECOVERY="true", the recovery mode wont show up in boot. I did it and pressed ESC and left Shift keys, recovery mode is gone now. –  eli Mar 17 '13 at 0:16
1  
@eli If the system is relatively current and the CPU supports AES-NI (and the Linux disk encryption mechanism, I'm not sure but imagine it does), then the overhead of full-disk encryption is very tiny, even with an SSD. It's not zero, but it's quite close to it... And that's without putting a significant load on the CPU. –  Kitsune Mar 17 '13 at 0:30
1  
@Kitsune Yes, Linux will use AES-NI if the processor supports it. –  Gilles Mar 17 '13 at 0:36
1  
A BIOS password is little better than simply having a password on your login account. Full-disk encryption or encryption of your home directory is the only way to meaningfully prevent an unauthorized user from accessing your files. It is completely transparent, and has an unnoticeable effect on performance. –  Stephen Touset Mar 17 '13 at 6:58
1  
@eli Your passphrase is never stored anywhere on the disk. The encryption software makes a one-way computation to obtain the encryption key from the passphrase. If you enter the wrong passphrase, a different key is computed and you can't decrypt the data. –  Gilles Mar 17 '13 at 20:07

other simple thing you can do is put password on the bios and hard drive,( most laptops have this feature and isn't easy to bypass) so there is no chance to run a live cd or usb without entering the password before, hope this help

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.