Question 42.1 - Local Security

francesco.iennarella

Hello,
I am sure there is a mistake in suppose that a boot loader password can protect from avoid the boot of the OS from USB external device as correct answer. Can you confirm it?

Thanks
Francesco

KonstantinA

I haven't done that lab yet, but you have to keep in mind, that we care about servers, located in a locked basement, inside the company's building, or at a data center, at a country up in the North, where the cooling is cheaper.

Even if we consider desktop workstations, there are workarounds. Let's say someone has a CD/DVD with a bootable Linux image.
You can limit this risk by removing the CD-ROM/DVD drive.
For a USB drive, you could modify BIOS to prevent booting from USB devices.

jnthn

@francesco.iennarella said:
Hello,
I am sure there is a mistake in suppose that a boot loader password can protect from avoid the boot of the OS from USB external device as correct answer. Can you confirm it?

Thanks
Francesco

I don't think so. The BIOS/UEFI will protect the hardware from boot media other than the fixed disks. That and access control to either the physical device or hypervisor.

luisviveropena

Hi Francesco,

I don't think there is an error. If you configure a password for the BIOS, and previously you de-selected "boot from USB", you won't be able to boot from an USB disk.

Regards,
Luis.

francesco.iennarella

Hello Luis,
it's ok for BIOS password. But if you only set a password for boot loader such as GRUB and not BIOS, it doesn't prevent boot from USB or DVD (in the last case if this media was not removed as KostantinA said).

Regards

coop

This is all depends on whether you have "trusted boot" enabled in the BIOS or not and how your OEM has manufactured the BIOS and the machine. It is specifically engineered to prevent from booting from portable media such as CD/DVD or USB and was rather a pain for Linux to deal with. (You are supposed to be able to turn off trusted boot on x86, but it is not required on other chips, by the specification.)

This is a long and complicated subject full of controversy and we don't want to get into holy wars about it. I suggest you study it.

I have turned it off in all my local machines as I am not worried about an international espionage agent cat burglar breaking into my house at night and hacking into my computer, the only USB I ever boot off of I make myself, and it is a pain to deal with. I'm not a great fan of grub passwords either, because my general feeling is if someone can physically touch your machine the battle is lost anyway. However, if you have a laptop and you don't want border crossing officials to get into it you can employ this, but they can force you to give up passwords anyway, at least in China and the USA, so you are better off bringing a machine with nothing on it across the border.