Hardening LILO Against Unauthorized Access

Like most programs, the Linux kernel itself can take 'command line'

arguments. These arguments can be specified when you select your kernel

at boot time, for example:

lilo: linux single

The command above tells lilo to run the Linux kernel with the argument

'single', which means single user mode. In this situation, linux will

load and enter run state 1. (In fact, you could have said '1' instead of

'single'.) In single user mode, the root filesystem is mounted

read-only, the network isn't initialized, and no daemons are running.

It's the perfect situation for you to fix problems that are keeping your

machine from booting.

When you enter single user mode, you are automatically dropped into a

root shell, without typing a password. Unfortunately, anyone with

physical access can easily get a root shell his way.

This problem has two solutions:

1) Configure lilo to prevent folks from sending arguments to the

kernel at the lilo prompt.

You specify 'restricted' in the image specification and pick a

password. They can still choose to boot this image, but they cannot boot

send it command line options unless they know this password. Your image

definition will look something like this:

image=/boot/vmlinuz

label=linux

restricted

password=SuperSecretPassword

read-only

root=/dev/hda7

If you choose this method, make sure you:

# chmod 600 /etc/lilo.conf

This prevents users from reading the password. Then re-write your lilo

configuration with:

# lilo

2) Force root to type the root password, even when entering single

user mode.

This involves running sulogin when the machine enters run level

zero. Add the following to /etc/inittab:

~~:S:wait:/sbin/sulogin

This command tells init (the first process that starts when linux is

booted) to run the sulogin program automatically. sulogin prints the

following to your tty:

Give root password for system maintenance

(or type Control-D for normal startup):

If you know the root pw, you are dropped to a root shell. If not, then

sorry -- no root for you.

It's important to remember that this method handily prevents you from

entering your own system in single user mode if you forget the root

password! [1]

NOTES

[1] If sulogin determines that there is no usable root password in

/etc/shadow or /etc/passwd because the files have been horribly mangled,

then it will give you root access automatically because no valid

authentication is possible.

What’s wrong? The new clean desk test
Join the discussion
Be the first to comment on this article. Our Commenting Policies