12

I want to host a website on a desktop computer running Ubuntu with a Windows virtual machine. I will give away the computer in exchange for a number of months of remote web hosting. I want to add some kind of lock (hardware or otherwise) so that the end users will have difficulty just reinstalling Windows and using the machine as they want, in contradiction to the contract.

Ideally, I'd want the machine to die if reinstallation of the OS is attempted. It doesn't have to be completely insurmountable, but it has to be difficult enough to prevent casual reinstallation. Perhaps on bootup the system can check whether certain files exist on the computer and refuse to boot if they do not. I don't know if this is possible, but maybe BIOS is password protected, and searches for files before boot up. The files it looks for could be date sensitive, i.e. require remote replacement on a schedule.

28
  • 4
    Who is going to be doing this hosting for you? If you don't trust them to not wipe the computer, why would you trust them with your website's data?
    – nhinkle
    Feb 15, 2011 at 20:04
  • 16
    It's the golden rule of computer security: if somebody has direct access to the hardware, then any protections you put in place can be defeated. I just don't see why you would want to do this. If they turn off the computer or have any sort of problem with it, your website is suddenly gone. A cheap shared hosting plan is much less expensive than buying a computer would be, and gives you guaranteed uptime, backups, and proper sysadmins.
    – nhinkle
    Feb 15, 2011 at 20:29
  • 2
    Please don't downvote this just because you don't agree with the idea of locking a computer. Companies lock cellphones. People unlock the cellphones. That's fine with me I'm looking for the same idea. This question is in the right forum as far as I can tell, if you downvote, please leave a comment here to let me know what I did wrong.
    – D W
    Feb 16, 2011 at 0:38
  • 7
    This is a totally valid question - the need to lock down a computer to prevent the OS from being modified is completely on-topic and there are many good reasons to do so. I personally feel like your ultimate goal is illogical, but it is still a valid question.
    – nhinkle
    Feb 16, 2011 at 1:34
  • 3
    I think it is a good question, clearly and politely explained, on-topic and with much response of the OP to comment all the answers. Even id the answer is now you can't I can't see a reason why to down-vote, all the opposite: +1.
    – Trufa
    Feb 16, 2011 at 3:26

8 Answers 8

31

The only tools you have for preventing installation of a new operating system on standard PC hardware would be to do something like this:

  • Lock the case. Use the Kensington slot if your case has one, otherwise physically lock it somehow.

  • Configure a BIOS setup password.

  • Configure BIOS to boot only off of first hard drive, to not boot off any external USB device, LAN, or CD-ROM. Ship the computer without a CD-ROM and/or floppy if possible. Internally disconnect or epoxy USB ports.

  • I'm not sure if you can configure GRUB to never boot from an external drive, but if it's possible, GRUB should be configured this way.

  • Select good root and user passwords.

Of course, if they physically open the case, you can't do much, but this should prevent casual reinstallation of another operating system.

13
  • 2
    +1 Yes preventing casual reinstallation is what i want to do. I would like a method that allows CD-ROM and USB usage though. No one wants a computer without a CD-ROM.
    – D W
    Feb 15, 2011 at 20:04
  • 7
    Then ship it with a CD-ROM/floppy, but without the CD-ROM or floppy connected to the motherboard.
    – LawrenceC
    Feb 15, 2011 at 20:14
  • 1
    That is not helpful to me and doesn't solve the problem. Nice try though.
    – D W
    Feb 16, 2011 at 0:09
  • 7
    @D W Actually what he said covers you. He said "Ship the computer without a CD-ROM and/or floppy if possible" So, what if not possible? Look at the sentence he wrote before that, it says "Configure BIOS to boot only off of first hard drive, to not boot off any external USB device, LAN, or CD-ROM"
    – barlop
    Feb 16, 2011 at 1:37
  • @barlop you are right. I thought ultrasawblade was being sarcastic with his last comment but I need to reexamine this answer.
    – D W
    Feb 16, 2011 at 3:10
29

If you are giving someone physical access to a machine, there is nothing that you can do to stop them.

9
  • 3
    I should clarify that I'm trying to avoid casual reinstallation.
    – D W
    Feb 16, 2011 at 0:31
  • 1
    @D W - you can reset a BIOS password by moving a jumper on most motherboards. It would take someone 10 minutes to google it, 5 minutes to cut the lock and 2 minutes to remove the BIOS password. Really, there's no good way.
    – MDMarra
    Feb 16, 2011 at 1:05
  • 1
    @D W - so you asked this question so that someone could tell you to put a lock on it?
    – MDMarra
    Feb 16, 2011 at 1:24
  • 3
    +1 to this answer. There is no such thing as "casual installation" - anyone approaching your box with a boot cd will have it up and running the os of their choose quick smart. The best that any of the suggestions on this page will do is to prevent "accidental installation", whatever that may be.
    – bitslave
    Feb 16, 2011 at 13:31
  • 1
    @D W - You need to define "easily" then. To someone that wants to reinstall an OS, snipping a lock on the case and moving a jumper is pretty easy. I think many users on this site would be able to do that without even looking up which jumper to move. This sounds like you issue is more easily solved at a policy level, and not a technical level since it's literally impossible to solve at a technical level.
    – MDMarra
    Feb 16, 2011 at 14:44
5

You might want to replace any visible screws with security Torx, especially the screws holding the hard drive in place. That way they can't install another OS on a different hard drive, swap out the hard drive, then boot from the new hard drive. Anyone can buy security Torx drivers, but it'll slow down a normal person, who probably won't have any in their toolbox.

0
4

There are a few Dell computers that need an administrator password to boot from anything other than the Hard Drive. The downside being that if the CMOS battery is removed for 30 seconds, they would then be able to bypass any previously set BIOS settings as they are all completely restored. But that is just my 2 cents. Unless the person you are giving this too really knows that much about resetting the BIOS just to install Windows, then don't give them a computer, but otherwise, this can prevent casual installation.

3
  • +1 This is the first answer that approaches a solution. Do you have more information about this?
    – D W
    Feb 16, 2011 at 0:11
  • 2
    That is a usual BIOS feature, nothing special to DELL machines. Corporate PC often have a funny little lock to prevent you from removing the CMOS battery or doing other things (hardware keylogger, ...). They don't resist pure force, but you would recognize it afterwards, if they were broken. Feb 16, 2011 at 10:29
  • I mentioned the Dell machines due to my experience with using a BIOS lock on them. Obviously must be a feature that is used widely in a corporate setting.
    – paradd0x
    Feb 16, 2011 at 15:44
2

Do what most companies do, make them sign a contract saying that you refuse to support it if they change the operating system.

1
  • Thank you for your two cents. The end user will not need much support. This will not have any effect.
    – D W
    Feb 16, 2011 at 0:15
1

To the question from the comments:

Whether there is a way to make a computer die if it doesn't get internet connection for a few days.

Yes, possible, but only on a casual basis, and vulnerable to networking problems.

You may put a script into the init-script section, which checks for internetaccess, and does a shutdown if there is no access.

More elaborated scripts could write to a protocol, or access a website based on the date.

If the user has superuser privileges, he might detect the script, remove it, deactivate it and manipulate it in all ways.

Therefore you have to disable 'rescue'-mode in grub, and disable the possibility to modify grub by interruption on boot.

If the user encounters random network problems, the machine might shutdown unintentionally.

0
1
  • Set the BIOS to boot off the hard drive first (that removes the ability to boot from USB/CD-ROM)
  • Set a BIOS password
  • Make sure the OS user doesn't have admin privileges (i.e. so that they can't pop in an installation CD while in Windows/Linux and do it from there).

This should give you the security level it seems you are after.

2
  • You need to harden GRUB(2) too. Maybe you recognized that he told it will be an Ubuntu-PC with virtual Windows. Feb 16, 2011 at 10:32
  • This answer is similar to the one superuser.com/questions/246234/…. I will focus on that one for now.
    – D W
    Feb 16, 2011 at 17:50
0

As a hardware option, you could go with is a secure computer case. I purchased this case ages ago (it's no longer available, but gives you an idea for what you're looking for). It's got a locking front door, and a locking side panel (the other side panel is riveted on, does not come off). Basically, if it's all locked up, all you can access is the rear connectors and a few front-panel connectors (two usb, one firewire400). There's no access to the drives, power button, or reset button. The actual locking tab is only plastic, so I'm sure it could be broken with enough force, but you're not looking for CIA-grade security here. It should be enough to discourage them.

1
  • 1
    Just to let you know, FireWire allows direct DMA access.
    – kinokijuf
    Jan 14, 2013 at 11:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .