Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I purchased a new laptop recently, and I'm working on hardening it. Specifically, I'm interested in increasing my chances of recovering the machine in the event that it's ever stolen. The system runs Ubuntu 11.04 (Natty).

I've installed Prey on the machine, of course. I've also created a guest account that requires no password to log in, to give a would-be thief an opportunity to log into the machine so I can track him with Prey. (I've got some other pretty rad countermeasures on there too.) The last thing I want to get on there is a solid keylogger.

Does anyone have any keylogger experience? I've Googled around and know that there are options, but I was hoping to benefit from the community's expertise on the issue. Some options seem to have disappeared from the Canonical repositories recently (I was looking at lkl in particular), and I'm not clear what the current leaders are.

Do you have any recommendations as to which is the current "premier" Ubuntu Keylogger?

For what it's worth, this whole venture was inspired by the fantastic "Pwned by the Owner" talk from Defcon 18. It definitely warrants a watch if you've never seen it before.

Thanks, everyone.

share|improve this question
Downside to this is you may be logging your passwords in plaintext. – Antonius Bloch May 29 '11 at 4:39
I'd like to make a couple recommendations: set a bios password and boot set only to HD, full disk encryption. Give passwords and keys in a sealed envelope to your wife/trusted pal. – Antonius Bloch May 29 '11 at 4:44
@Antonius Bloch I'm likely going to install the keylogger to a truecrypted volume or something. That way, it will be securely disarmed until I explicitly arm it (remotely) in the event that the laptop is stolen. That should nullify the very legitimate concern you raised about logging my own passwords. Thanks! – chrisallenlane May 31 '11 at 0:19
up vote 4 down vote accepted

I would go with LKL myself, but that is very subjective - others will prefer something else, I'm sure.

It doesn't matter whether or not it is in a repository, in fact I would want to build something like that myself from source.

There is of course a risk with having a keylogger installed - it could be used against you!

share|improve this answer
If you build it yourself, you also take on responsibility for building it right, keeping it up-to-date with security patches, etc. Not to be taken lightly.... – nealmcb May 28 '11 at 18:38
@nealmcb - definitely! – Rory Alsop May 28 '11 at 20:18
LKL logs physical keyboard strokes, anyone know anything that might log things like remote ssh sessions? – Antonius Bloch May 29 '11 at 4:41
Auth.log for the logins – Rory Alsop May 29 '11 at 13:53
Good points here. For the time being, I'll probably at least start with trying to build LKL from source. I'm going to install it into a truecrypted volume, to keep it from being used against me! – chrisallenlane May 31 '11 at 0:23

I'm interested in increasing my chances of recovering the machine in the event that it's ever stolen.

I like Rory's answer. However, I think there are three risks involved here: the risk of loosing your hardware, and the risk of loosing your data, and the risk of your private data being exposed. Solutions which attempt to recover the machine are only solving one risk.

The risk of data loss can be mitigated by a good data backup system.

The risk of data exposure may be mitigate by good data protection: proper access controls, solid encryption, and good keys or passwords. The risk of data exposure may also be mitigate by destruction: remote wiping, conditional wiping, timed expiration. The final risk is the loss of your hardware.

When you have risk there are three options: mitigate the risk, assume the risk, and transfer the risk. You have already though of some way to mitigate the risk of theft. However you havn't covered a few of the most effective, which tend to be operation rather than technical.

Never leave your laptop unattended. If a thief has no opportunit they can not steal your laptop.

When you are not using your laptop store it securely. At least use a locking cable attached to something unmovable. Or keep it in a locked drawer or cabinet. If you are not in a familiar place you can lock it in the trunk of your car.

Mark your laptop with your name in a way that is difficult to remove. You can have it etched into the case, or failing that large letters in permanant marker. It makes it harder for a thief to sell Chris's laptop, and if you put contact information as well it will help get it returned if you loose it.

Another way to deal with risk is assuming the risk, but I don't recommend doing that.

The final way to deal with risk is to transfer it. This is usually done by buying insurance. You can buy laptop theft insurance to cover the value of your laptop. If this is a personal laptop and you have homeowners insurance you may already be covered under personal property, or you may be able to add coverage to an existing policy for a small fee. I don't know insurance very well but I think renters insurance may act similarly to homeowners insurance. In any case you can check with your insurance agent.

share|improve this answer
There is a 4th valid response to a risk: remove the risk (e.g. dont have a laptop...). – AviD Jul 17 '11 at 13:00

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.