We use a small computer with linux attached to a big tv to display some data to the public. Normally, there is no keyboard connected. When a keyboard is connected at boot, we start the configuration screens. A browser displayed in full screen after boot.

I protected the BIOS with password.

How can I avoid that someone connects in single user mode to access to files.

Is there other things that I can do to protect against hack ?

Thanks in advance

  • Rule of the thumb: If you can physically touch a device, you own it. If anyone can physically reach the box, they can pretty much do whatever they want. – Luc Dec 7 '12 at 14:40

Option 1: try to restrict access

In addition to setting a BIOS password...

Set a password for grub (this prevents changing of the stored boot command lines, but tere are still ways around this)

Require the root password for access in single-user mode.

Restrict physical access to the box and it's ports.

Option 2: make the controlled content unavailable at boot time

Keep all the sensitive content in an encrypted filesystem with a manually entered passphrase. Add an unmount script for the filesystem to the runlevel scripts.

Obviously Option 2 does not provide for protection against malware installed on the system after you come along and mount the encrypted filesystem - hence you should use both approaches.

| improve this answer | |

You could always utilize a USB port blocker to physically block access to any USB ports. You only really need one of these per device... the other USB ports can be dealt with super glue (or most likely a different non-permanent solution).

| improve this answer | |

You need to protect the system to prevent physical access, otherwise anyone with a USB keyboard can gain control of your system.

There are a couple of options you could explore if you are willing to require that someone be present every time the system need to be booted:

  • Bios password/boot password: you could set a boot password to prevent unauthorized users from booting the system
  • Key based encryption: you could require a USB key be inserted to boot and decrypt the system

As I said, these will prevent unauthorized use but the system can't reboot on its own, someone would have to go there.

| improve this answer | |
  • Thoses screens are installed on site. They have physical access to them... Do you have other ideas to prevent abuses ? Thanks ! – hotips Dec 6 '12 at 19:58
  • When GdD says "prevent physical access", it most likely means to keep the box enclosed in a locked cabinet, or in a separate room. The screen is an unlikely attack point; you should concentrate on protecting the computer itself. – Jonathan Garber Dec 6 '12 at 20:15
  • That's exactly what I meant, thanks @JonathanGarber – GdD Dec 7 '12 at 9:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.