Re: Single user mode

Markus Gutschke (gutschk@uni-muenster.de)
20 Jan 1997 18:40:55 +0100

zblaxell@myrus.com (Zygo Blaxell) writes:
> Put a password on the BIOS, and another on LILO, and make sure your
> /etc/rc scripts don't suddenly jump out of e2fsck into a root shell.
> If you *can* prevent the case from being opened, then this extra hardening
> is very useful.

So what do you do about

- a system BIOS that has known backdoors, i.e. passwords that will
always let you in?

- a system BIOS that supports hot-keys for clearing the entire CMOS
memory including the password?

- a user who brings a boot disk? (this requires that he persuaded the
machine to boot from floppy)

- a user who brings his own laptop, disconnects your machine from the
net and connects his laptop instead? (in many cases this can be done
without any supervisor noticing it)

- if you offer operating systems other than Linux, then chances are
that it is even easier to break both into your machine and into
your network.

- ...

I still believe that the PC architecture does not provide any
reasonable security, if you can gain physical access to the
machine. Other architectures might be better off, but it appears that
most of them still have some exploitable backdoors.

Markus

-- 
Markus Gutschke          Internet:       gutschk@math.uni-muenster.de
Schlage 5a               PGP public key: finger -l gutschk@math.uni-muenster.de
D-48268 Greven-Gimbte
Germany                            >>> I prefer encrypted e-mail <<<