Linux Root Recovery

Question

On Ubuntu 10.10 I can login as root without the root password by replacing ro quiet splash with rw init=/bin/bash. How can I secure my machine and disable this backdoor?

Answer 1

You need to secure several things, as leaving any of these open introduces a door (it's not really a backdoor since it's all well documented) of similar impact. (Exception: if at step 1 you can physically secure the console as well, then you don't need to do anything else.)

1. Physically secure the computer. You must prevent attackers from disconnecting the disk from the computer and connecting it to another computer that they control, and from resetting the firmware access control.
2. Protect the boot process in computer's BIOS (or other boot firmware) with a password (or other form of access control). Make sure the internal hard disk is the only selected boot medium, so as to prevent attackers from booting from a live CD, USB or other media. Of course, lock access to the BIOS as well, so that the attacker can't change that setting.
3. Protect the bootloader so that booting anything but the default command line requires providing a password.

Steps 1 and 2 are about your hardware and not about the operating system, so if you have trouble with them, ask on Super User. For step 3, what to do depends on your bootloader (which you haven't indicated). The default bootloader on Ubuntu is Grub 2.

First, generate a password hash with grub-mkpasswd-pbkdf2.

Next, declare a user and password by creating an executable (mod 755 or 700) file called /etc/grub.d/01_users (it matters that the file beings with 01) with these contents (where grub.pbkdf2.….DEADBEEF is what grub-mkpasswd-pbkdf2 produced):

#!/bin/sh -e
## Declare users and passwords
cat <<EOF
set superusers="torayeff"
password_pbkdf2 torayeff grub.pbkdf2.sha512.10000.DEADBEEF
EOF

Only authenticated superusers may edit menu entries or enter a command line. Other users may only boot prepared entries.

If you want to also restrict some boot entries to authenticated user, replace menuentry "name" by menuentry "name" --users "user1 user2" in the place where they are generated. The entries for your Linux installation, memtest86 and any other OS you may have on that machine are in /etc/grub.d/10_linux, /etc/grub.d/20_memtest86+ and /etc/grub.d/30_os-prober respectively.

When you've made changes in /etc/grub.d, run sudo update-grub before rebooting.