Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 2 down vote favorite

May be this is a silly question but yesterday I found myself struggling to execute the sudo command because apparently I was taken off the list on my own machine for some reason. What I did was to restart my operating system (Ubuntu) and boot into the recovery console and execute:

adduser <username> admin

and it said, user <username> was successfully added into the admin group. I start my operating system and voila, I have sudo privileges as expected. I am totally confused and must have been sleeping in class but is this good or bad? Of course, I am totally happy that I got back my privileges but...

Can I just restart any machine and add myself to the admin group or was I able to do this because this was my machine? Any thoughts?

share|improve this question
First lesson from Security 101: Once an attacker has physical access, all bets are off. Everything else just builds on that. – Michael Kjörling Oct 10 '11 at 11:51

migrated from stackoverflow.com Oct 10 '11 at 11:24

1 Answer

up vote 3 down vote accepted

This is somewhat harmless, because if you have physical access to the machine so you can boot into the recovery console, you can do anything you want anyway. You could just pull the plug and steal the harddrive, and mount it in another computer, do anything you want with any of the files.

Even if you only have "non-physical, virtually physical" access such as via KVM-over-IP or what they're called, you could still boot any other system and mount the disk, and send any data over the network, or do whatever you want.

Which leads to the solution: If you want to prevent someone from doing such a thing, use an encrypted file system such as Truecrypt or similar (or, at least, use an encrypted home folder, which Ubuntu supports out of the box, and which should be enough).

share|improve this answer
Nothing will ever prevent someone from doing something nasty. Security will at most ever will make attacks easier to detect and significantly slower (and arguably harder) +1 nevertheless. – Kimvais Oct 7 '11 at 18:59
True. Though of course an encrypted filesystem (assuming a not-trivially-guessable, non-dictionary password, and a non-broken crypto implementation) is admittedly beyond the scope of most attackers. Maybe the NSA will have no trouble breaking the encryption (though they will probably instead just hood and waterboard you until you tell the password -- that's cheaper), but any random person who walks past your computer (or steals it) won't get very far. Which likely is just good enough for anyone not selling nuclear weapon secrets. – Damon Oct 7 '11 at 19:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.