Is this true 2

[Caluser]

http://blacksun.box.sk/mirror/lilo.html

mark.p

 

[fluid11]

Yes, there is no security on a Linux box if your sitting in front of the actual machine, but so what? Yes, you can change the root password but you can also pick the box up and throw it down a flight of stairs too


ChrisP

 

[piti]

if you are worried that somebody who knows this could have access to you machine you can set a password for the booted image (options password and restricted for the lilo.conf) - but this can be i think overriden by using a boot floppy

 

[danielhozac]

Or you could set a BIOS password if your BIOS supports this. //Daniel

 

[Caluser]

Just what I thought so in reality linux security is really not that much different than any other OS if you know what you're doing.

 

[wmg]

What if you are using GRUB - does that allow you to do the same thing?

I know you can specify a GRUB password as well - just in case your BIOS doesn't support that option (or you don't want to use it).

Thanks.
wmg

 

[fluid11]

Same thing with GRUB, except its done a little differently. Basically, all you are doing is booting into single user mode and changing the root password.

Caluser..."Just what I thought so in reality linux security is really not that much different than any other OS if you know what you're doing." --> No, Linux security is a lot better than M$ security, for example. Regardless of what kind of server you are running, you must keep your servers locked up in a secure location.

If you don't want to lock your server up, then you can use a BIOS password and a GRUB password.


ChrisP

 

[hads]

Caluser,

Denying physical access to a server is a fundamental rule of security.

Regardless of OS: If you have physical access, you have root/administrator privileges.



01101000011000010110010001110011

 

[rycamor]

There is an additional step that can be taken for situations where physical security is not enough: encrypted filesystems. If the whole filesystem is encrypted, or at least the partitions with your sensitive data, then someone would not be able to do something more than throw the thing down a flight of stairs.

AFAIK many new laptops, especially by IBM, support this kind of feature, with a special onboard tamper-proof encryption chip. This means that one can not gain access to the data without the encryption key, period. The only thing they could do is destroy the hardware, losing your data.

Here are some helpful links, courtesy of Google:

http://www.tldp.org/HOWTO/Loopback-Encrypted-Filesystem-HOWTO.html

http://www.linux-sec.net/FileSystem/#Encrypted

http://sdb.suselinux.hu/en/sdb/html/jsj_crypto_filesystem_mini_howto.html

As you can see, "Loopback" is the most common, and simple method, but probably not as secure as some of the more encompassing crypto systems. -------------------------------------------

Big Brother: "War is Peace" -- Big Business: "Trust is Suspicion"
(

http://www.cl.cam.ac.uk/~rja14/tcpa-faq.html)

 

[MrTom]

From my default lilo.conf file.

# You can set a password here, and uncomment the `restricted' lines
# in the image definitions below to make it so that a password must
# be typed to boot anything but a default configuration.  If a
# command line is given, other than one specified by an `append'
# statement in `lilo.conf', the password will be required, but a
# standard default boot will not require one.
#
# This will, for instance, prevent anyone with access to the
# console from booting with something like `Linux init=/bin/sh',
# and thus becoming `root' without proper authorization.
#
# Note that if you really need this type of security, you will
# likely also want to use `install-mbr' to reconfigure the MBR
# program, as well as set up your BIOS to disallow booting from
# removable disk or CD-ROM, then put a password on getting into the
# BIOS configuration as well.  Please RTFM `install-mbr(8)'.