0

I have a problem with people having illegal access to lab computers bypassing strong password protections.

Several computers at my VLSI labs at college have Windows 7 HE installed. Some are dual-booting machines with Fedora or Ubuntu installed. All Windows machines have user accounts by department, while the Fedora/Ubuntu ones are open to all. All machines are connected at time to a local LAN, and have internet access.

Recently, I have found that some people are accessing the admin accounts and making unauthorized changes/downloads/installs. Some basic research suggested chntpw is probably to blame. The admin looked at logs and found some of the culprits - but it's always retrospective action.

I also found some enterprising people using Live CDs and replacing the Utilman.exe with cmd.exe, gaining root access during login and replacing the admin password using the net user command.

Most (but not all) perpetrators are being caught, but only after the damage is done.

My question is how do I stop these people, without removing either OS, banning physical media or starting body searches ?

Preventive measures would be best. Although I would take real-time detection, if possible, as well.

Improve this question
1
  • Thank you for all your suggestions. I've followed @JimSalter and applied TrueCrypt to a test case of ~10 machines and it seems to be working. Much appreciated.
    – RaunakS
    May 1, 2013 at 23:08

2 Answers 2

Reset to default
4

You don't, really. Physical access == root.

You can potentially make things somewhat more difficult, depending on your hardware, by protecting your BIOS/UEFI access, and disabling USB/optical media booting. That leaves the Linux side. If you allow your users root on the Linux boot, then again, you're screwed - root means ROOT, so if they want to mount your ntfs partitions and do some handy-dandy editing, there's not really any way to stop them.

If you DON'T give them root on the Linux side, of course, then no problem - you'd need root access to mount the ntfs partition.

Improve this answer
5
  • I see, but I can't disable physical media access - people use USB stick and copy out data in CDs all the time. And root access in Linux is NOT given, but installing chntpw just requires sudo. So, basically I'm screwed. Thanks all the same.
    – RaunakS
    Apr 29, 2013 at 20:45
  • 1
    You can disable physical media BOOTing without disabling ACCESS. Go into the BIOS/UEFI setup on the machines, lock the boot order, and then password-protect access to the BIOS/UEFI itself. That will, of course, still not keep them from running chntpw from the Linux side, if you give them full sudo access (which IS, effectively, root access). But it'll probably keep some punks out, and make it easier to catch some of the others (if they're not bright enough to use their untrammeled sudo access to sweep the logs behind themselves).
    – Jim Salter
    Apr 29, 2013 at 20:48
  • Oh, of course, I should have thought of that. I'll try that out & see how they bypass access this time. But full sudo access is mandatory I'm afraid - professors get angry if their students are denied anything.
    – RaunakS
    Apr 29, 2013 at 20:52
  • But on the bright side, we caught around 60% by tracing logs - so they're not all geniuses.
    – RaunakS
    Apr 29, 2013 at 20:52
  • If students need full access, perhaps consider setting up a really light-weight linux install, and then Virtualbox/Vmware Workstation. Completely lock down the host OS, and let them go to down in the guests.
    – Zoredache
    Apr 29, 2013 at 21:12
0

Setup bitlocker. Full disk encryption will make it difficult/impossible for them to change anything without breaking the entire system.

You will need systems with a TPM for the transparent operations mode though. You need to use the TPM to have minimal impact to the user experience. You would need to upgrade to a edition of Windows that supports Bitlocker also.

Improve this answer
5
  • That is a very good suggestion, but upgrading several dozen W7 HP/Prof edition to Enterprise as well as installing TPM chips is a ... costly option. Are there similar free software ?
    – RaunakS
    Apr 29, 2013 at 21:20
  • 1
    @RaunakS You may want to take a look at Truecrypt. It may do what you need. You could also talk to the professors and see what Linux utilities they'd need root access for... then create a group that has access to those utilities. But anyone who knows Linux and teaches use of it should also understand the risk of root access not only locally but potentially on the domain.
    – nerdwaller
    Apr 29, 2013 at 23:32
  • @nerdwaller That does seem useful - I'll try it out. Thank you for the advice.
    – RaunakS
    Apr 30, 2013 at 4:23
  • TrueCrypt definitely does work; I've used TrueCrypt to encrypt entire Windows systems both on the bare metal and in virtual machines. If you TrueCrypt it, the students can't get into it... EXCEPT, and this is a big except, whoever boots the machine INTO windows needs to know the TrueCrypt key or you can't boot it any more than you can modify it.
    – Jim Salter
    Apr 30, 2013 at 21:44
  • @JimSalter Fair point. I'll try to separate Linux and Windows access. I think I'll combine your suggestions and TrueCrypt and see how it turns out. I just hope I don't end up sacrificing ease of use for security.
    – RaunakS
    Apr 30, 2013 at 21:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .