Warp wrote:
> Darren New <dne### [at] sanrrcom> wrote:
>> Warp wrote:
>>>   Resetting the root password from local console is not a security hole.
>>> It's regular maintenance. It's by design.
> 
>> Possibly, depending on how you think about it.  It certainly makes for 
>> insecure personal desktop computers in a corporate environment, for 
>> example.
> 
>   I was mainly talking from the point of view of the owner of the
> computer, which is naturally also its administrator.

Right. And I was pointing out that resetting the root password from the 
local console is indeed a security hole if the owner of the computer 
isn't the one sitting at the console.  Makes sense?

>   It would, quite naturally, not make too much sense that if you forgot
> the root password, you would be completely stuck and the computer would
> become completely unmaintainable. There must, of course, be some way of
> resetting the root password (given that you have direct physical access
> to the computer). It's just common sense.

Sure. But preserve all the data of everyone on the machine when 
resetting the password is less secure than resetting the password by 
wiping out all data on the machine.

>   Security of the data is not the same as security of the system.
> If someone can hack into your computer and delete all your encrypted
> files (or worse, replace them with something else without you noticing
> for a long time, perhaps messing up your backups), I wouldn't call that
> security.

Right.

>   Accounts, access control, etc. are only good for remote access.

I disagree. If they're only good for remote access, why is there advice 
that you shouldn't log in as root for everyday use?

> If someone has direct access to your computer, they serve only as a
> deterrent for the novice and a slowdown for the expert. There's little
> stopping the user from eg. booting from a linux installation disk and
> wiping out the contents of the HDs.

Again, you're making a boolean description of security. The fact that 
you can destroy the computer doesn't mean it's "insecure".

>> This would be factually incorrect also, unless you believe ...
> 
>   You mean some OS can stop someone from booting from a CD and wiping
> the HDs, for example?

No, but that's *more* secure than someone booting from a CD and reading 
all your files. That's why they invented paper shredders.

I'd rather have my backup disks, when stolen by a thief, get wiped out 
and sold as blank media than to have all my personal information 
accessible to the thief.  There's not too much you can do to keep the 
disk from getting stolen, but you can keep the data from getting stolen.

>   If someone has direct physical access to the computer, it is insecure.

Well, in some senses of the word, it's insecure. In other senses, it 
isn't. If I boot Vista and I need to put a USB frob in to decrypt the 
boot partition, the machine is significantly more secure than if I'm 
running Win98, even if neither machine is plugged into a network at all.

> Remote access can be made much more secure.

No question there. Remote access prevents a number of attacks. But that 
doesn't mean local access must or even should allow all attacks.

-- 
   Darren New / San Diego, CA, USA (PST)
     Remember the good old days, when we
     used to complain about cryptography
     being export-restricted?

Post a reply to this message

> OK. Well 42 FPS is still faster than you need.

Need for what?

>> 25 fps looks very jerky compared to 30 or 60 fps for CG.
>
> Really? I observed virtually no visible difference at all (except the 
> speed of the motion).

Well of course everybody has different perception of flicker/motion 
blur/smoothness, look at the attached that I made in POV a while back (I 
think it is xVid format, can't remember).  The balls are bouncing at 60, 30 
and 15 fps.  If you can't see the difference between the "smoothness" of the 
red and green balls then I guess you're lucky as you can tolerate lower 
framerates in games (==cheaper hardware) :-)

Post a reply to this message

Attachments:
Download 'out.avi.dat' (601 KB)

>  Accounts, access control, etc. are only good for remote access.
> If someone has direct access to your computer, they serve only as a
> deterrent for the novice and a slowdown for the expert. There's little
> stopping the user from eg. booting from a linux installation disk and
> wiping out the contents of the HDs.

That may be so, but they wouldn't be able to read my data, or modify it 
without me noticing (eg that the HD has been wiped, or certain files give an 
error when trying to load).  They need my password and my USB security key 
to be able to do that.

Post a reply to this message

Darren New <dne### [at] sanrrcom> wrote:
> Right. And I was pointing out that resetting the root password from the 
> local console is indeed a security hole if the owner of the computer 
> isn't the one sitting at the console.  Makes sense?

  Well, if you can reinstall linux in the computer, then that's basically
the same level of insecurity as being able to reset the root password.

> >   It would, quite naturally, not make too much sense that if you forgot
> > the root password, you would be completely stuck and the computer would
> > become completely unmaintainable. There must, of course, be some way of
> > resetting the root password (given that you have direct physical access
> > to the computer). It's just common sense.

> Sure. But preserve all the data of everyone on the machine when 
> resetting the password is less secure than resetting the password by 
> wiping out all data on the machine.

  How is the OS going to stop someone from booting from a specially created
CD which allows you to read the contents of the HDs regardless of what
the ownership flags of the files are?

  The only way to reduce that risk is to encrypt the files, but in that
case then even being able to reset the root password is not going to help
in decrypting them.

> >   Accounts, access control, etc. are only good for remote access.

> I disagree. If they're only good for remote access, why is there advice 
> that you shouldn't log in as root for everyday use?

  If you are referring to protection against fumbling things (eg.
accidentally writing "rm /"), then of course it's a good thing to not
to be always logged as root. However, I was talking from the point of
view of a malicious user who wants to do some mayhem to the system.
Accounts are of no use if the malicious person has direct access to
the computer.

> Again, you're making a boolean description of security. The fact that 
> you can destroy the computer doesn't mean it's "insecure".

  Then we disagree.

> >   You mean some OS can stop someone from booting from a CD and wiping
> > the HDs, for example?

> No, but that's *more* secure than someone booting from a CD and reading 
> all your files. That's why they invented paper shredders.

  If your files are encrypted then the root password is of no use to
decrypt them. You can only do the same thing as you could do with the
boot CD: Destroy or modify the files.

> I'd rather have my backup disks, when stolen by a thief, get wiped out 
> and sold as blank media than to have all my personal information 
> accessible to the thief.  There's not too much you can do to keep the 
> disk from getting stolen, but you can keep the data from getting stolen.

  What does this have to do with you being able to reset the root password?

> > Remote access can be made much more secure.

> No question there. Remote access prevents a number of attacks. But that 
> doesn't mean local access must or even should allow all attacks.

  Being able to reset the root password and being able to boot from a CD
are basically the same thing. The only way you can "protect" anything is
by encryption, in which case neither thing is too helpful in decrypting.

-- 
                                                          - Warp

Post a reply to this message

scott <sco### [at] laptopcom> wrote:
> That may be so, but they wouldn't be able to read my data, or modify it 
> without me noticing (eg that the HD has been wiped, or certain files give an 
> error when trying to load).  They need my password and my USB security key 
> to be able to do that.

  The only way to achieve that is encrypting the files, in which case being
able to reset the root password is of no additional help (compared to being
able to boot from a CD).

  Being able to reset the root password and being able to boot from a CD
are basically the same thing, when you have direct access to the computer.

-- 
                                                          - Warp

Post a reply to this message

>  The only way to achieve that is encrypting the files, in which case being
> able to reset the root password is of no additional help (compared to 
> being
> able to boot from a CD).

How are you going to reset the root password if the harddrive is encrypted?

Post a reply to this message

scott <sco### [at] laptopcom> wrote:
> >  The only way to achieve that is encrypting the files, in which case being
> > able to reset the root password is of no additional help (compared to 
> > being
> > able to boot from a CD).

> How are you going to reset the root password if the harddrive is encrypted?

  Perhaps you didn't understand what I said?

  Let me rephrase: Not being able to reset the root password does not add
any security compared to being able to boot from a CD.
  Conversely, being able to reset the root password is no more insecure
than being able to boot from a CD.
  Neither thing is going to help you decrypting those files. However,
both things can be used to abuse the system in other ways.

  I'm certain you can set up linux in a way that it's not possible to
reset the root password. However, that's somewhat moot if you are still
able to boot from a CD. Just boot from a CD and you have root access to
the HD. The only way to try to protect from that is to disable booting
from CD from bios and put a bios password. Of course this is only a slight
slowdown, not a working security measure (because that doesn't stop the
malicious person from physically removing the HD from the computer and
putting it in another), but it introduces a maintenance disadvantage:
You'd better not forget the bios password.

  The thing is, no matter what you try to do, if the malicious person has
direct access to the computer, it will be insecure. The only thing you can
do is to encrypt your data, in which case it doesn't matter if the root
password can be reset (because the root password doesn't help you decrypting
the files). This is completely equivalent to being able to boot from a CD,
and also to be able to remove the HD from the computer and putting it in
another.

  The initial claim was that being able to reset the root password (when
you are using the computer directly, not remotely) is somehow a security
hole. This is nonsense. It's not more of a security hole than being able
to boot from a CD or being able to physically transfer the HD to another
computer.
  You can, of course, disable this. However, it would be mostly useless
from a security point of view.

-- 
                                                          - Warp

Post a reply to this message

>  The thing is, no matter what you try to do, if the malicious person has
> direct access to the computer, it will be insecure. The only thing you can
> do is to encrypt your data, in which case it doesn't matter if the root
> password can be reset (because the root password doesn't help you 
> decrypting
> the files).

Unless your particular encryption system works transparently to the user for 
each account automatically (like it does in Win XP).  If that was the case, 
being able to gain access as root would allow you to access all the files 
encrypted by root.  Is it impossible that there is some software for Linux 
that works in a similar manner?  (ie you can only "decrypt" by logging in 
with a particular account, not from examining HD contents).

Post a reply to this message

> 
>   The thing is, no matter what you try to do, if the malicious person has
> direct access to the computer, it will be insecure. The only thing you can
> do is to encrypt your data, in which case it doesn't matter if the root
> password can be reset (because the root password doesn't help you decrypting
> the files). This is completely equivalent to being able to boot from a CD,
> and also to be able to remove the HD from the computer and putting it in
> another.

Not 100% equivalent.

Changing a password is something you can do in a few seconds, and is barely
noticeable.

Rebooting on a CD is a slightly more noticeable operation.

And, if a password-locked BIOS is configured to prevent boot from CD,
removing the hard drive is very very noticeable.

See, there's still some levels in-between...

>   The initial claim was that being able to reset the root password (when
> you are using the computer directly, not remotely) is somehow a security
> hole. This is nonsense. It's not more of a security hole than being able
> to boot from a CD or being able to physically transfer the HD to another
> computer.

It's a higher risk, since it can be done so quietly compared to the other
options you cite.

Fabien.

Post a reply to this message

Fa3ien <fab### [at] yourshoesskynetbe> wrote:
> Changing a password is something you can do in a few seconds, and is barely
> noticeable.

  Not if you have to boot into single-user mode to do it.

> Rebooting on a CD is a slightly more noticeable operation.

  As well as rebooting into single-user mode.

-- 
                                                          - Warp

Post a reply to this message