I am currently investigating using Linux Laptops for my development team. We currently run Windows. The one advantage that keeps coming up for Windows over Linux from a system administration / security perspective is the fact that if a laptop is stolen, it can be remotely wiped upon boot.

I have been trying to find information on this capability for Linux based workstations, but I have come up empty handed. Do any of you use Linux in an Enterprise environment on Workstations and if so, has this been a requirement that you have solved? I'm not sure where else to look.

Thank you

  • 8
    you should look for some kind of whole disk encryption solutions supported on Linux...
    – Mallik
    Feb 23, 2012 at 13:17
  • 1
    I think we have that - but the remote wipe capability is still a barrier.
    – rbieber
    Feb 23, 2012 at 13:30
  • 5
    Why would you need remote wipe on boot if you have whole disk encryption? If the laptop is stolen while the data is unlocked you're SOL, and if you don't trust the encryption then what's to stop someone transferring the data to another computer before cracking it, without ever rebooting or connecting to the Internet?
    – l0b0
    Feb 23, 2012 at 13:38
  • 2
    Continuing what @noktec mentioned, even for Windows, the remote wipe capabilities are, well... limited. Given an ideal set of circumstances, sure the laptop will be wiped - but it is easy for a smart attacker to prevent that, and thus prevent the wipe. That would only work either for a clueless attacker, or one that is willing to play by your rules :)
    – AviD
    Feb 23, 2012 at 14:14
  • 1
    I would suggest taking a look at Protecting a Laptop from Simple and Sophisticated Attacks. It's probably the best introduction to laptop security I've seen.
    – Gerry
    Feb 23, 2012 at 14:19

4 Answers 4


I've had a look and I think this question provides some interesting options. I'll summarise them here:

  • dd if=/dev/zero of=/dev/sdaX copies zeros over your whole disk. rm -rf --no-preserve-root / recursively deletes all files on a disk, overriding the rm -rf / warning on systems where that is enabled. If you can get to a box via ssh, running the dd variant should pretty effectively destroy your disk.
  • The grub option is interesting in that it gives you VNC access - however it would likely be obvious to the attacker that you're launching VNC - they'd need to hit the right grub option for starters! A hidden grub menu with the real launch entry might suffice... but we're talking about trickery.
  • This AskUbuntu question deals with this issue too, recommending a solution.

If you're prepared to do some work yourself, you could configure a very-early-stage init entry with sysvinit or whatever your system uses - check a url you control e.g. https://remotecheck.yourcompany.com and if the device is stolen, begin a wipe.

The ultimate problem with any remote wipe solution is invoking it - you need to be able to access the device. The reason I mention using a custom init-invoked job is that it is more likely you'll have access out than direct or known access in - i.e. if the attacker is behind a router at their base of operations, chances are good that outbound connections are allowed and much lower that they have an IP you can bind to and allow incoming connections on.

Of course, none of these solutions actually guarantee anything - if the attacker knows how they work they can just turn them off. A solution mentioned in comments is to use disk encryption, which will make the disk unreadable under these caveats:

  • the whole disk is encrypted - otherwise your software might write to unencrypted areas.
  • the system is powered off or for example luksSuspend -wipe has been run to remove the keys from memory.
  • the attacker has had no way to observe the key entry prior to stealing the device.

Honestly - I'd go with disk encryption.


The data may be protected by encrypting the hard disk with Truecrypt for example but this is not enough...

EDIT: check the important comment of Oliver Salzburg about the difference between HD vs Data encryption.

I think the best way to protect and, sometimes, to recover, a stolen laptop is to use an application dedicated for this purpose such as Prey or LoJack. LoJack for example use some low level features in some laptop model to protect it even the hard disk is removed... This is called a "persistence module" installed in some computers models.

Check at Absolute Software web site for a list of computers/models with this technology.

Also look at (for example):

LoJack: http://www.absolute.com/en/lojackforlaptops/home.aspx

Prey: http://preyproject.com/

Hope this help. Let us know.

  • 2
    In fact, it may be more desirable to not encrypt the OS hard drive, so that the operating system (and Prey) can run if the laptop is stolen. This might allow you to track down the device. You should still make sure your data is encrypted though. Feb 23, 2012 at 13:57
  • Thank you for this information about Prey and crypted HD vs encrypted data.
    – climenole
    Feb 23, 2012 at 14:05
  • A friend also recommended looking at Intel Active Management Technology
    – rbieber
    Mar 15, 2012 at 16:40

Just a quick option I'll throw out there: have it create an SSH tunnel on boot.

You'll have full control over all it's resources as long as it has an internet connection from work. Need to wipe it? Wipe it. Need to grab a file from someone out of the office? Install software? Mount a server resource for them? Install VNC and punch another tunnel and remote assist them.

I believe you can edit a sshd config file so that on tunnel creation with a specific PC you can automate a wipe and log that it's been done.

If anyone else thinks a good idea, I guess we can start poking around as to the viability of it.

Of course if you have full disk encryption, they'll have to boot into the OS to get to this point (as it is now, with Windows, you cannot wipe them until they've cracked your disk encryption, which likely means they've already cloned everything... if you're doing full disk encryption anyway).


I use LUKS to encrypt entire hard disk.

If you install Scientific Linux 6 or recent Fedora, you can find a check box to encrypt it. It will require a passphrase at startup.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .