Prevent hacking the grub.conf using a 'live rescue' from a live linux iso

Question

It happened that I had set the grub password in grub.conf. But, using a live linux iso, I was able to delete the password from the grub.conf. Please read the steps for the same mentioned in this link: http://gofedora.com/how-to-recover-crack-root-password-grub-locked/

Instead of editing menu.lst, I edited the grub.conf. Rest all steps same

My question is: Is there a way to prevent such a hack. When I tried rescuing, the system showed a message that if it is not able to rescue (i.e. if it fails mounting the HDD under the directory: /mnt/sysimage), do I want to continue/skip/abort.

So, I feel that there must be a concrete way of preventing such hacks by doing something with the mounts/boot etc, which shall prevent mounting into /mnt/sysimage.

Any help would be valuable

Edit:

PS: Please re-consider this environment for a virtualised environment where the actual VM in VSphere is a linux VM, and I need to disable/delete the CD/DVD-Rom and network boot from BIOS. After doing all that stuff, I want to re-package the VM into .ovf and check whether the new ovf has the BIOS restrictions or not.

Answer 1

In addition to the grub password, you also need to configure the BIOS to not allow booting from media other than the device that contains your primary OS. You will want to set a BIOS password so this configuration can not be changed.

Unless your drives are encrypted, physical access to the machine is access to your data. Even with a BIOS password the CMOS can be reset by opening the chassis and removing the battery.

Answer 2

You can put all the restrictions you want on the bootloader that's on the disk, this doesn't help if someone boots without using that bootloader.

You can tighten down by configuring your BIOS to refuse booting from any other media, in particular from removable disks or over the network. Be sure to put a BIOS password so that the attacker can't change the setting back.

If the attacker has access to the disk and can insert it into another machine, nothing you can do with the bootloader or with your BIOS will prevent him from reading the content of the disk (including executing the operating system that's on the disk). In that case your only recourse is to arrange that reading the disk isn't useful to the attacker: encrypt the disk with dm-crypt, and don't tell the attacker the passphrase (which you'll have to type when you boot, so your computer knows it's you).