[lkml]   [1997]   [Jan]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: Single user mode
On 20 Jan 1997, Markus Gutschke wrote:

> (Zygo Blaxell) writes:
> > Put a password on the BIOS, and another on LILO, and make sure your
> > /etc/rc scripts don't suddenly jump out of e2fsck into a root shell.
> > If you *can* prevent the case from being opened, then this extra hardening
> > is very useful.
> So what do you do about
> - a system BIOS that has known backdoors, i.e. passwords that will
> always let you in?
> - a system BIOS that supports hot-keys for clearing the entire CMOS
> memory including the password?

avoid those BIOS's like the plage

> - a user who brings a boot disk? (this requires that he persuaded the
> machine to boot from floppy)

cut it up, ban him/her, be draconian (or cut them up, and ban the floppy,
whichever ;)

> - a user who brings his own laptop, disconnects your machine from the
> net and connects his laptop instead? (in many cases this can be done
> without any supervisor noticing it)

I don't really have a problem with this one, it's much the same as a user
telneting in from outside, they may be smart enough to take the address
off the machine they unpluged, but it shouldn't give them an advantage
(Ie you shouldn't uncontionally allow your trusted hosts to get any access
they like).

> - if you offer operating systems other than Linux, then chances are
> that it is even easier to break both into your machine and into
> your network.

Yep, proberbly quite easy if you give them dos, but something more secure
(NT, *BSD*, ...) should be ok.

> - ...
> I still believe that the PC architecture does not provide any
> reasonable security, if you can gain physical access to the
> machine. Other architectures might be better off, but it appears that
> most of them still have some exploitable backdoors.

Well assuming that you can't get into the BIOS through a backdoor, then a
C: A: boot order (or C: only), and lilo on the HD (no prompting, instant
boot into first and only OS, asks for passwords if you try to do hold down
shift, and try to pass something (like init=...)), and sulogin if fsck
fails. Should make farly certen that it's braking the running system
that's the line of attack (that and a large padlock and some steal work to
stop "internal modifications" ;)

> Markus
Oh, btw which bios's are know to have backdoors (I don't care what they
are, just which) ?
PGP key pass phrase forgotten, \ Overload -- core meltdown sequence
again :( and I don't care ;) | initiated.
/ This space is intentionally left
| blank, apart from this text ;-)

 \ /
  Last update: 2005-03-22 13:38    [W:0.039 / U:0.036 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site