On Ubuntu 10.10 I can login as root without the root password by replacing
ro quiet splash with
rw init=/bin/bash. How can I secure my machine and disable this backdoor?
You need to secure several things, as leaving any of these open introduces a door (it's not really a backdoor since it's all well documented) of similar impact. (Exception: if at step 1 you can physically secure the console as well, then you don't need to do anything else.)
- Physically secure the computer. You must prevent attackers from disconnecting the disk from the computer and connecting it to another computer that they control, and from resetting the firmware access control.
- Protect the boot process in computer's BIOS (or other boot firmware) with a password (or other form of access control). Make sure the internal hard disk is the only selected boot medium, so as to prevent attackers from booting from a live CD, USB or other media. Of course, lock access to the BIOS as well, so that the attacker can't change that setting.
- Protect the bootloader so that booting anything but the default command line requires providing a password.
Steps 1 and 2 are about your hardware and not about the operating system, so if you have trouble with them, ask on Super User. For step 3, what to do depends on your bootloader (which you haven't indicated). The default bootloader on Ubuntu is Grub 2.
First, generate a password hash with
Next, declare a user and password by creating an executable (mod 755 or 700) file called
/etc/grub.d/01_users (it matters that the file beings with
01) with these contents (where
grub.pbkdf2.….DEADBEEF is what
#!/bin/sh -e ## Declare users and passwords cat <<EOF set superusers="torayeff" password_pbkdf2 torayeff grub.pbkdf2.sha512.10000.DEADBEEF EOF
Only authenticated superusers may edit menu entries or enter a command line. Other users may only boot prepared entries.
If you want to also restrict some boot entries to authenticated user, replace
menuentry "name" by
menuentry "name" --users "user1 user2" in the place where they are generated. The entries for your Linux installation, memtest86 and any other OS you may have on that machine are in
When you've made changes in
sudo update-grub before rebooting.