up vote 3 down vote favorite
1
share [g+] share [fb]

I have been shown that a FreeBSD system can easily be accessed in single user mode without the root password. Using the passwd command will allow anyone withh physical access to the system to change the password for root. Is there any way to prevent this? Before learning this I was told bsd systems are secure but now i am not so sure.

link|improve this question
1  
really funny, i'm going favorite this question, so i can have some laughs later on! – alexus Dec 20 '09 at 4:33
I dont see whats funny – The BSD Guy Dec 20 '09 at 5:35
feedback

3 Answers

up vote 7 down vote accepted

You simply need to edit /etc/ttys to prompt for a password in single user mode, although keep in mind anyone with physical access to the machine can still retrieve your data through various methods.

you will find a line that looks like this which is tab delimited in /etc/ttys:

console none   unknown off secure

change the secure part to insecure (very confusing, I know) so the line looks like this:

console none   unknown off insecure

upon rebooting and entering single user mode, you will be prompted for a password to get to the shell prompt.

This is what the FreeBSD guys have to say about using the word insecure in /etc/ttys:

Note: An insecure console means that you consider your physical security to the console to be insecure, and want to make sure only someone who knows the root password may use single-user mode, and it does not mean that you want to run your console insecurely. Thus, if you want security, choose insecure, not secure.

link|improve this answer
Just to note, i believe this is the correct answer ;) – Journeyman Geek Dec 20 '09 at 7:19
this solution makes sense for our current circumstance but i will also be asking the company to provide better security in the datacenter. thanks. – The BSD Guy Dec 20 '09 at 23:27
feedback
up vote 5 down vote

Any system that's physically accessable has the potential to be insecure. Even if your installed OS is secure, someone could, in theory use a live disk to edit security settings, reset passwords, or simply get data out.

I suppose you have to disable USB and cd boot and lock the bios to be totally safe. And even then someone could always take th HDD out.

I hope i don't make you too paranoid ;)

link|improve this answer
Yes but i mean like in an environment such as a datacenter where the towers are locked in a shelf and the keyboard and mouse are visible and attached to a monitor. Nobody can insert a cd this way but other people who purchase rack space can access the keyboard to our servers. We are considering encrypting the drive contents just in case. – The BSD Guy Dec 20 '09 at 5:24
Data centers SHOULD have a degree of physical security - no one should be able to walk over to a rack they arn't supposed to have access to and meddle with it. If not, you might need to talk to them about it. – Journeyman Geek Dec 20 '09 at 6:19
feedback
up vote 1 down vote

Increase physical security.

link|improve this answer
see comment above please – The BSD Guy Dec 20 '09 at 5:24
The one you wrote after I answered? Oh, OK. Cool. – briealeida Jan 9 '10 at 8:23
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.