Date: Fri, 5 Dec 2003 14:57:20 +0000 From: Matthew Seaman <m.seaman@infracaninophile.co.uk> To: Lowell Gilbert <freebsd-questions-local@be-well.no-ip.com> Cc: freebsd-questions@freebsd.org Subject: Re: protecting loader Message-ID: <20031205145719.GB96968@happy-idiot-talk.infracaninophile.co.uk> In-Reply-To: <44llpr1i8a.fsf@be-well.ilk.org> References: <20031204141547.T598@genisis> <44llpr1i8a.fsf@be-well.ilk.org>
next in thread | previous in thread | raw e-mail | index | archive | help
--CdrF4e02JqNVZeln
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
On Fri, Dec 05, 2003 at 08:56:05AM -0500, Lowell Gilbert wrote:
> Dru <dlavigne6@sympatico.ca> writes:
> > Is there a way to prevent a user from bypassing loader and
> > loading/unloading stuff at the OK prompt? (other than physical security
> > measures)
=20
> I don't know, but I don't think it will help much. It would still be
> possible to come up in singler-user mode, which let the user bypass
> anything you set up anyway.
Getting access to the loader prompt gives you rather more power than
just single user mode. An attacker can boot their own kernel --
either from removable media or over the net -- can load their own
kernel modules into your regular kernel -- how about a module that
traps all of the keystrokes on each tty/pty: passwords would be a dime
a dozen -- and all sorts of other hijinks.
Single user mode can be protected by setting the console status to
insecure in /etc/ttys -- which will require that the root password is
given for access. That protection is trivially bypassed with a fixit
disk and access to the loader/boot prompt.
The only other possible protection is to set a BIOS password, but that
means the machine will not re-boot unattended.
If you want to allow free access to a machine in a public place, then
to prevent people taking it over you need to:
i) Physically prevent them from using their own removable media --
floppy, CD and DVD drives either have to be removed, or secured
by lock and key[1].
ii) USB and other ports must be inaccessible -- can't get round the
protections by installing your own hardware.
iii) Must not use the local keyboard/mouse/video card for the system
console -- making the serial port carry the console is a good
idea, especially if you can arrange for a secured console
server. The public absolutely has to be prevented from
accessing the system console. Even so, while you can redirect
the system console from within FreeBSD, you can't do similarly
with the BIOS setup screens. For that you need something like
a RealWeasel card.=20
Setting up an automatic login on the publically accessible terminal --
so that the attacker cannot access the Login: prompt is a good idea.
Making that auto-login run a restricted software environment under a
non-privileged UID -- usually some sort of menu system or web-based
interface which restricts what the user may do to a small subset of
commands would be a good idea.
As would booting from read-only media -- not having a writable hard
drive in a machine does cramp the style of most attackers.
Cheers,
Matthew
[1] If you need access to these devices while running -- say you're
setting up a kiosk system where you can record music tracks onto CD-RW
-- then it should be possible to disable the devices in the BIOS, so
the system will ignore them at boot time, but let the usual boot-time
hardware probe find them so that they're available at run time. Of
course, in this scenario, you'll have to prevent any attacker getting
access to the BIOS setup, which is very difficult on a standard PC
system.
--=20
Dr Matthew J Seaman MA, D.Phil. 26 The Paddocks
Savill Way
PGP: http://www.infracaninophile.co.uk/pgpkey Marlow
Tel: +44 1628 476614 Bucks., SL7 1TH UK
--CdrF4e02JqNVZeln
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (FreeBSD)
iD8DBQE/0JzPdtESqEQa7a0RAjebAJ4s5H4Qxbk3zK1toG8C+5c1iRMO7ACfeAzh
+cs/Bq3esy0WynJMOEt5GP4=
=FgEj
-----END PGP SIGNATURE-----
--CdrF4e02JqNVZeln--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20031205145719.GB96968>