I'm a little security paranoid, there are a lot of times that my terminal is available to prying eyes and listless fingers. As a security minded individual, I would like to make sure to lock down my Ubuntu (11.04b3) install in one of the best ways I can think of, and require a dongle to access my box. Is this something any of you other security minded people have done?

What are other great ways to lock my terminal? I would like to make sure that not only the "average" user, but also the ABOVE average user will not be able to penetrate my system without a key. Let me know what you think, and other measures I can take.

  • This should be on super user I think. – Preet Sangha Apr 26 '11 at 19:47
  • 3
    Remove the hard drive, make the "dongle" a 16GB thumb stick, and install ubuntu on the stick. – JasonWoof Apr 26 '11 at 19:50
  • 1
    @Jason I'd thought about that, using a 64gb drive and Rijndael to encrypt the actual usb. Issues: 1. Contact terminals on USBs are prone to failure. 2. USBs are small, if lost you are SOL. 3. Ability to "Palm" your device and walk away with it. The ability to us a dongle would mean if your key is lost, it CAN be replaced without worry of data loss. – ehime Apr 26 '11 at 19:57

Alternate solution: lock your system and use biometric ID (e.g fingerprints) to unlock.

  • We've actually been talking about biometric support in another forum, interesting that you'd mention it. – ehime Apr 28 '11 at 16:52

Trying to make sure nobody can use your computer is a completely futile effort. (See 10 Immutable Laws of Security)

On the other hand, making sure nobody can (reasonably) see your... stuff, for lack of a better term, is fairly easy. Ubuntu provides, built-in, a method to encrypt your home folder, which would, in a sensible configuration, contain all your personal data. ( https://help.ubuntu.com/community/EncryptedHome )


I would suggest you encrypt your user profile and use a very strong password. The easy way of using a really long password is to use a Yubikey static password combined with a password you know.

Another way which I have not tried but it looks really cool is to use the Yubikey One-Time-Password for user authentication. Here is a guide on how to set it up.. it would be a different password each login so the Yubikey dongle would be required.

Yubikey keeps getting better and better so keep an eye on it one of the more recent versions has RFID in it which could more than likely be set up for login as well.

You can have a static password and a OTP password on one dongle which is also really nice for using Lastpass

Note: The dongle is essentially a USB keyboard so it works cross-platform without need for extra drivers etc.


First of all I recommend to encrypt you hard drive. So nobody could read you data even if he removes the drive (suggesting you have a BIOS password!).

To make the authentication to your system more secure take a look at pamusb. You can configure an USB pen drive for auth (maybe in combination with a password). Here is a quickstart.
But keep in mind to have a backup of this pen, otherwise a fault of this drive will close the door for ever ;-)

And of course the best you can do is always installing security updates!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.