Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

It happened that I had set the grub password in grub.conf. But, using a live linux iso, I was able to delete the password from the grub.conf. Please read the steps for the same mentioned in this link: http://gofedora.com/how-to-recover-crack-root-password-grub-locked/

Instead of editing menu.lst, I edited the grub.conf. Rest all steps same

My question is: Is there a way to prevent such a hack. When I tried rescuing, the system showed a message that if it is not able to rescue (i.e. if it fails mounting the HDD under the directory: /mnt/sysimage), do I want to continue/skip/abort.

So, I feel that there must be a concrete way of preventing such hacks by doing something with the mounts/boot etc, which shall prevent mounting into /mnt/sysimage.

Any help would be valuable

Edit:

PS: Please re-consider this environment for a virtualised environment where the actual VM in VSphere is a linux VM, and I need to disable/delete the CD/DVD-Rom and network boot from BIOS. After doing all that stuff, I want to re-package the VM into .ovf and check whether the new ovf has the BIOS restrictions or not.

share|improve this question
add comment

2 Answers

In addition to the grub password, you also need to configure the BIOS to not allow booting from media other than the device that contains your primary OS. You will want to set a BIOS password so this configuration can not be changed.

Unless your drives are encrypted, physical access to the machine is access to your data. Even with a BIOS password the CMOS can be reset by opening the chassis and removing the battery.

share|improve this answer
1  
How about in a Virtualised environment where I have a VM in VSphere ? –  GodMan Aug 21 '12 at 14:18
    
@GodMan Don't allow attackers access to your hypervisor? Then they won't be able to insert a disc, even. –  derobert Aug 22 '12 at 13:36
add comment

You can put all the restrictions you want on the bootloader that's on the disk, this doesn't help if someone boots without using that bootloader.

You can tighten down by configuring your BIOS to refuse booting from any other media, in particular from removable disks or over the network. Be sure to put a BIOS password so that the attacker can't change the setting back.

If the attacker has access to the disk and can insert it into another machine, nothing you can do with the bootloader or with your BIOS will prevent him from reading the content of the disk (including executing the operating system that's on the disk). In that case your only recourse is to arrange that reading the disk isn't useful to the attacker: encrypt the disk with dm-crypt, and don't tell the attacker the passphrase (which you'll have to type when you boot, so your computer knows it's you).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.