Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

A few days ago, a friend of mine, wanted to show me that he can use my linux even if I don't tell him my password.

He entered in GRUB, selected the recovery mode option. My first problem is that he already had access to my files (read only). He tried to do passwd but failed. Then he did some kind of remount (I guess that gave him write rights) and after that he was able to change my password.

Why is this possible? I personally see it a security issue. Where I work there are several people that use linux and neither of them have a BIOS password set or some other kind of security wall.

share|improve this question
23  
Doing this does require physical access to the computer. Realistically, unless you use TrueCrypt or similar, if I have physical access to your computer, I can probably get at your data one way or another. –  Zac B Oct 18 '12 at 14:41
9  
This is not specific to Linux. With physical access, you can do the same on Windows, OSX or probably any OS. One of the reasons I can see to be this way is that an admin can allways forget his password and needs a way to get in the system. –  laurent Oct 18 '12 at 16:28
    
Even if you can't log on to OS installed on the hard-drive, you can just boot a liveUSB distro, and mount the files systems and read all the files. You can always encrypt your home directory though, lots of distros have an option for doing that on install. That will safeguard most data from being read. (although it won't stop it being erased) –  naught101 Oct 18 '12 at 23:50
3  
With a screwdriver, this can be done to most anything... –  SamB Oct 19 '12 at 1:33

4 Answers 4

up vote 42 down vote accepted

The passwords are meant to prevent access from outside (network, internet), and they accomplish it. However, physical access is root access.

Unless you're encrypting your entire partition, it's always possible to boot from an optical disc or a flash drive and gain access to all your files. This way, you can also modify the files that store the users' passwords.

However, you can choose to disable the recovery mode of you want to. Steps:

  1. Open /etc/default/grub in a text editor (with root privileges)

  2. Uncomment/add the line following line:

    GRUB_DISABLE_RECOVERY="true"
    
  3. Save the changes and run the following command:

    sudo update-grub
    
share|improve this answer
3  
Disabling the BIOS password only takes a little longer. You can reset by setting the Clear CMOS jumper or by removing the CMOS battery. Also, you can still access the hard drive in any other computer computer. –  Dennis Oct 18 '12 at 14:51
3  
No. If somebody removes an unencrypted hard drive from your computer and connects it to one of his own, he can read from and write to the hard drive. It really doesn't matter what you do to the rest of the computer. –  Dennis Oct 18 '12 at 14:57
6  
Put it in a safe. –  Chris Nava Oct 18 '12 at 14:58
12  
If the drive is encrypted its still encrypted even if the drive is stolen. You don't encrypt a storage device to prevent the theft of the storage device. –  Ramhound Oct 18 '12 at 16:31
2  
Even if you don't show the 'recovery mode' option, you still have access to the grub console. If you don't want an outsider to have access to the grub console, you should put a password to grub –  Carlos Campderrós Oct 18 '12 at 19:40

If someone can physically touch your machine they can get in.

Easiest way, load linux on a usb drive and boot from the usb stick. Voila, you can view the native file system and make whatever changes you like.

share|improve this answer

For grub 1 do the following:

  1. Open a command line and enter as root grub-md5-crypt

  2. You are being asked for a password and after confirming your password you will see a hashvalue which you copy to the clipboard

  3. Open your editor of choice and edit /boot/grub/menu.lst and add to the first line:

    password --md5 "Hashvalue"
    
  4. Safe the file. The hashvalue is the one you get from the command grub-md5-sum

For grub2 there is a tool which lets you setup this more easy http://sourceforge.net/projects/grubpass/ After installing just type:

  1. grubpass into the shell as root user. The program is pretty much self explanatory.

However the best way to protect your data from this kind of access is to use full disk encryptpion.

share|improve this answer

It will always be possible to change the root password. It can always happen that someone forgot it. You need physical access to the server (or console access when virtualized) to enter the GRUB recovery mode, so when you are already there you can take the whole server/desktop as well to pull out the HDD and do some forensics on it. Safety-wise it does not matter a lot.

You can always encrypt your disc if you want additional security. That will make recovery a lot harder.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.