Welcome to the Linux Foundation Forum!

Question 42.1 - Local Security

francesco.iennarella
francesco.iennarella Posts: 5
in LFS201 Class Forum - Discontinued

Hello,
I am sure there is a mistake in suppose that a boot loader password can protect from avoid the boot of the OS from USB external device as correct answer. Can you confirm it?

Thanks
Francesco

Comments

  • KonstantinA
    KonstantinA Posts: 29

    I haven't done that lab yet, but you have to keep in mind, that we care about servers, located in a locked basement, inside the company's building, or at a data center, at a country up in the North, where the cooling is cheaper.

    Even if we consider desktop workstations, there are workarounds. Let's say someone has a CD/DVD with a bootable Linux image.
    You can limit this risk by removing the CD-ROM/DVD drive.
    For a USB drive, you could modify BIOS to prevent booting from USB devices.

  • jnthn
    jnthn Posts: 12

    @francesco.iennarella said:
    Hello,
    I am sure there is a mistake in suppose that a boot loader password can protect from avoid the boot of the OS from USB external device as correct answer. Can you confirm it?

    Thanks
    Francesco

    I don't think so. The BIOS/UEFI will protect the hardware from boot media other than the fixed disks. That and access control to either the physical device or hypervisor.

  • luisviveropena
    luisviveropena Posts: 1,343

    Hi Francesco,

    I don't think there is an error. If you configure a password for the BIOS, and previously you de-selected "boot from USB", you won't be able to boot from an USB disk.

    Regards,
    Luis.

  • francesco.iennarella
    francesco.iennarella Posts: 5

    Hello Luis,
    it's ok for BIOS password. But if you only set a password for boot loader such as GRUB and not BIOS, it doesn't prevent boot from USB or DVD (in the last case if this media was not removed as KostantinA said).

    Regards

  • coop
    coop Posts: 917

    This is all depends on whether you have "trusted boot" enabled in the BIOS or not and how your OEM has manufactured the BIOS and the machine. It is specifically engineered to prevent from booting from portable media such as CD/DVD or USB and was rather a pain for Linux to deal with. (You are supposed to be able to turn off trusted boot on x86, but it is not required on other chips, by the specification.)

    This is a long and complicated subject full of controversy and we don't want to get into holy wars about it. I suggest you study it.

    I have turned it off in all my local machines as I am not worried about an international espionage agent cat burglar breaking into my house at night and hacking into my computer, the only USB I ever boot off of I make myself, and it is a pain to deal with. I'm not a great fan of grub passwords either, because my general feeling is if someone can physically touch your machine the battle is lost anyway. However, if you have a laptop and you don't want border crossing officials to get into it you can employ this, but they can force you to give up passwords anyway, at least in China and the USA, so you are better off bringing a machine with nothing on it across the border.

Categories

Upcoming Training