4

Very recently I recovered a root password for a Debian server by booting into single user mode. This resulted in me having access to a shell with root privileges (prompt said "root@none") Now this has left me wondering why a potential intruder can't just reboot a system and use the same process to reset the root password and infiltrate your treasure trove?!

See (https://serverfault.com/questions/482079/debian-boot-to-single-user-mode)

  • Most computer security systems accept this limitation. Generally speaking, if you have physical access to a machine, you can do anything you want to it. Trying to protect against physical tampering is a physical realm solution - software cannot help with that unless you are willing to make emergency recovery difficult. – Brandon Jun 23 '16 at 23:31
  • This is why you lock computers in cages – Neil McGuigan Jun 24 '16 at 17:40
3

Several reasons: one, you have to have physical access to the servers, and most employees don't want to lose their jobs by getting caught on CCTV video breaking into systems. Then, you have some companies that implement BIOS / boot passwords or boot loader passwords. Sometimes, the "single user" option requires a password (if set up properly ahead of time), other times it simply isn't available.

Ultimately, though, you're correct - this is a very exploitable attack vector.

3

A potential intruder could reboot into single user mode if they had physical access. Physical security is just as important as software security. That is why schools lock out USB drives and the BIOS. You have to lock it down.

In /etc/default/grub you can uncomment the following line

GRUB_DISABLE_RECOVERY="true"

And poof! Single User mode is now gone.

  • 3
    You should also set a GRUB password (to prevent someone from appending init=/bin/bash to your kernel cmdline) and lock down the BIOS (so that no one can circumvent your security measures with a Live CD). You could even encrypt to root partition to ensure that no one can access your data by removing the hard disk. But even then you're still vulnerable because someone could put an exploit into your unencrypted /boot partition so you'd need to move that onto a USB stick and always carry it with you. But your firmware is still vulnerable. Or just accept that perfect security isn't achievable:) – Martin von Wittich Jun 23 '16 at 19:22
  • 4
    ... And then a creative student figures out to short the battery, and poof! The BIOS and USB locks are now gone... Really, physical access = root, period. – Satō Katsura Jun 24 '16 at 7:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.