{"id":637,"date":"2012-10-16T15:36:11","date_gmt":"2012-10-16T14:36:11","guid":{"rendered":"http:\/\/blogs.silicontechnix.com\/?p=637"},"modified":"2012-10-16T15:38:46","modified_gmt":"2012-10-16T14:38:46","slug":"securing-linux-for-physical-access","status":"publish","type":"post","link":"https:\/\/blogs.silicontechnix.com\/?p=637","title":{"rendered":"Securing Linux for Physical Access"},"content":{"rendered":"<p>&nbsp;<\/p>\n<p>Physical access is everything, it is almost impossible to prevent machine access\/password break if somebody else got physical access to some Linux machine.<\/p>\n<p>But there are some steps you can make somebody work hard to access the machine physically (provided they have good knowledge of Linux).<!--more--><\/p>\n<p><strong>1) Add Password to Grub<\/strong><br \/>\nPassword-protecting the bootloader is one method you may employ to enhance the physical security profile of your computer. GRUB, the <strong>GR<\/strong>and <strong>U<\/strong>nified <strong>B<\/strong>ootloader, is the default bootloader on virtually all Linux distributions, but on a significant number, the installer does not have support for setting a GRUB password.<\/p>\n<ul>\n<li>Prevent Access To Single User Mode \u2014 If an attacker can boot into single user mode, he becomes the root user<\/li>\n<li>Prevent Access To the GRUB Console \u2014 If the machine uses GRUB as its boot loader, an attacker can use the edit the command\u2019s interface to change its configuration<\/li>\n<\/ul>\n<p>1.1 From a shell terminal, run the <strong><em>grub-md5-crypt<\/em><\/strong> command. The password that\u2019s requested will be the one that will be used to protect GRUB. It should not be the same as that of any user account on the system, certainly not the same as the root password. Note the md5 hash generated. You will need it in the next step<\/p>\n<p><a href=\"https:\/\/blogs.silicontechnix.com\/wp-content\/uploads\/2012\/10\/grub-crypt.png\"><img loading=\"lazy\" decoding=\"async\" data-attachment-id=\"638\" data-permalink=\"https:\/\/blogs.silicontechnix.com\/?attachment_id=638\" data-orig-file=\"https:\/\/blogs.silicontechnix.com\/wp-content\/uploads\/2012\/10\/grub-crypt.png\" data-orig-size=\"274,76\" data-comments-opened=\"1\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;}\" data-image-title=\"grub-crypt\" data-image-description=\"\" data-image-caption=\"\" data-medium-file=\"https:\/\/blogs.silicontechnix.com\/wp-content\/uploads\/2012\/10\/grub-crypt.png\" data-large-file=\"https:\/\/blogs.silicontechnix.com\/wp-content\/uploads\/2012\/10\/grub-crypt.png\" class=\"aligncenter size-full wp-image-638\" title=\"grub-crypt\" src=\"https:\/\/blogs.silicontechnix.com\/wp-content\/uploads\/2012\/10\/grub-crypt.png\" alt=\"\" width=\"274\" height=\"76\" \/><\/a><\/p>\n<p>1.2 Edit <strong>\/etc\/grub.conf<\/strong> as shown in the image. Just add another line below the \u201ctimeout\u201d line and type in <strong><em>password \u2013md5 (md5 hash generated from step 1)<\/em><\/strong> as shown in the image. Save the file. Reboot and try to access other features of GRUB by pressing the \u201cp\u201d key<\/p>\n<p><a href=\"https:\/\/blogs.silicontechnix.com\/wp-content\/uploads\/2012\/10\/grubconf.png\"><img loading=\"lazy\" decoding=\"async\" data-attachment-id=\"639\" data-permalink=\"https:\/\/blogs.silicontechnix.com\/?attachment_id=639\" data-orig-file=\"https:\/\/blogs.silicontechnix.com\/wp-content\/uploads\/2012\/10\/grubconf.png\" data-orig-size=\"615,213\" data-comments-opened=\"1\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;}\" data-image-title=\"grubconf\" data-image-description=\"\" data-image-caption=\"\" data-medium-file=\"https:\/\/blogs.silicontechnix.com\/wp-content\/uploads\/2012\/10\/grubconf-300x103.png\" data-large-file=\"https:\/\/blogs.silicontechnix.com\/wp-content\/uploads\/2012\/10\/grubconf.png\" class=\"aligncenter size-full wp-image-639\" title=\"grubconf\" src=\"https:\/\/blogs.silicontechnix.com\/wp-content\/uploads\/2012\/10\/grubconf.png\" alt=\"\" width=\"615\" height=\"213\" srcset=\"https:\/\/blogs.silicontechnix.com\/wp-content\/uploads\/2012\/10\/grubconf.png 615w, https:\/\/blogs.silicontechnix.com\/wp-content\/uploads\/2012\/10\/grubconf-300x103.png 300w\" sizes=\"auto, (max-width: 615px) 100vw, 615px\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<p><strong>2) Disable single user mode<\/strong><br \/>\nTo block singe user or emergency login with password, append the following line in your \/etc\/inittab file.<br \/>\nsu:S:wait:\/sbin\/sulogin<br \/>\nNow each time someone tries to login as single user, they will be asked for root password<\/p>\n<p>&nbsp;<\/p>\n<p><strong>3) Redirect output to serial console<\/strong><br \/>\nFirst check your system have serial console, to check this type:-<\/p>\n<pre class=\"brush:bash\">root@localhost:~# dmesg | grep tty\r\nserial8250: ttyS0 at I\/O 0x3f8 (irq = 4) is a 16550A\r\n00:08: ttyS0 at I\/O 0x3f8 (irq = 4) is a 16550A<\/pre>\n<p>Ok , if you got the output like above, means we are good. Next step<\/p>\n<p>Now, we need to edit the GRUB configuration. Edit the \/boot\/grub.conf file (by typing <span class=\"system\">vi \/etc\/grub.conf<\/span>), and find this section: (only add the bold\u00a0 <strong>console=ttyS0,115200n8<\/strong> ) <span style=\"color: #ff0000;\"><strong>Edit grub.conf carefully it can make your system unbootable<\/strong><\/span><\/p>\n<pre class=\"brush:bash\">[root@localhost ~]# vi \/etc\/grub.conf \r\n# grub.conf generated by anaconda\r\n#\r\n# Note that you do not have to rerun grub after making changes to this file\r\n# NOTICE:  You have a \/boot partition.  This means that\r\n#          all kernel and initrd paths are relative to \/boot\/, eg.\r\n#          root (hd0,0)\r\n#          kernel \/vmlinuz-version ro root=\/dev\/mapper\/VolGroup-lv_root\r\n#          initrd \/initrd-[generic-]version.img\r\n#boot=\/dev\/md127\r\ndefault=0\r\ntimeout=5\r\npassword \u2013md5 $1$2Hsvs0$JvddxRBvNclESePZ4pE6Y.\r\nserial --unit=0 --speed=115200\r\nterminal --timeout=5 serial console\r\ntitle CentOS (2.6.32-279.9.1.el6.x86_64)\r\n        root (hd0,0)\r\n        kernel \/vmlinuz-2.6.32-279.9.1.el6.x86_64 ro root=\/dev\/mapper\/VolGroup-lv_root nomodeset rd_NO_LUKS LANG=en_US.UTF-8 rd_MD_U\r\nUID=eede5ac9:8fa8c5e6:c95ed758:c950d21f rd_LVM_LV=VolGroup\/lv_swap SYSFONT=latarcyrheb-sun16 crashkernel=auto rd_MD_UUID=e3497c4f:87\r\n1d4245:e017988c:7ca7addb rd_LVM_LV=VolGroup\/lv_root  KEYBOARDTYPE=pc KEYTABLE=us rd_NO_DM console=ttyS0,115200n8<\/pre>\n<p>So we only added console=ttyS0,115200n8 in the end of kernel line. Save grub.conf and reboot to test it.<\/p>\n<p>Also it is recommended to try those things one by one. Otherwise you can lock yourself out of the box !!<\/p>\n<p>That&#8217;s it for now, Enjoy !!<\/p>\n","protected":false},"excerpt":{"rendered":"<p>&nbsp; Physical access is everything, it is almost impossible to prevent machine access\/password break if somebody else got physical access to some Linux machine. But there are some steps you can make somebody work hard to access the machine physically (provided they have good knowledge of Linux).<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_s2mail":"no","jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false},"version":2}},"categories":[95,127],"tags":[283,282,83,281,286,287,19,285,284,76,278,279,280],"class_list":["post-637","post","type-post","status-publish","format-standard","hentry","category-system-administration","category-tips","tag-bootloader","tag-grand-unified-bootloader","tag-grub","tag-grub-conf","tag-hash","tag-inittab","tag-linux","tag-md5","tag-md5-crypt","tag-password","tag-physical-access","tag-single-user-mode","tag-sulogin"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p12j6H-ah","_links":{"self":[{"href":"https:\/\/blogs.silicontechnix.com\/index.php?rest_route=\/wp\/v2\/posts\/637","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.silicontechnix.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.silicontechnix.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.silicontechnix.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.silicontechnix.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=637"}],"version-history":[{"count":8,"href":"https:\/\/blogs.silicontechnix.com\/index.php?rest_route=\/wp\/v2\/posts\/637\/revisions"}],"predecessor-version":[{"id":647,"href":"https:\/\/blogs.silicontechnix.com\/index.php?rest_route=\/wp\/v2\/posts\/637\/revisions\/647"}],"wp:attachment":[{"href":"https:\/\/blogs.silicontechnix.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=637"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.silicontechnix.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=637"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.silicontechnix.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=637"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}