[aclug-L] FW: Hardening LILO Against Unauthorized Access

["Dale W Hodge" <dwh@xxxxxxxxxxxxxxxx>]

----Original Message-----
From: Linux_Security@xxxxxxxxxxxxxxx
[mailto:Linux_Security@xxxxxxxxxxxxxxx] 
Sent: Tuesday, June 25, 2002 1:35 AM


LINUX SECURITY --- June 25, 2002
Published by ITworld.com -- changing the way you view IT
http://www.itworld.com/newsletters
__________________________________________________________________

HIGHLIGHTS

* While the LILO boot loader's ability to take command line arguments 
  can allow you to repair boot problems, it can also allow unauthorized 
  root access to your system. 
__________________________________________________________________


Hardening LILO Against Unauthorized Access
By Brian Hatch

Like most programs, the Linux kernel itself can take 'command line'
arguments. These arguments can be specified when you select your kernel
at boot time, for example:

    lilo: linux single

The command above tells lilo to run the Linux kernel with the argument
'single', which means single user mode. In this situation, linux will
load and enter run state 1. (In fact, you could have said '1' instead of
'single'.) In single user mode, the root filesystem is mounted
read-only, the network isn't initialized, and no daemons are running.
It's the perfect situation for you to fix problems that are keeping your
machine from booting.

When you enter single user mode, you are automatically dropped into a
root shell, without typing a password. Unfortunately, anyone with
physical access can easily get a root shell his way.

This problem has two solutions:

    1) Configure lilo to prevent folks from sending arguments to the
kernel at the lilo prompt.
       You specify 'restricted' in the image specification and pick a
password. They can still choose to boot this image, but they cannot boot
send it command line options unless they know this password. Your image
definition will look something like this:

    image=/boot/vmlinuz
        label=linux
        restricted
        password=SuperSecretPassword
        read-only
        root=/dev/hda7

If you choose this method, make sure you:

    # chmod 600 /etc/lilo.conf

This prevents users from reading the password. Then re-write your lilo
configuration with:

   # lilo

    2) Force root to type the root password, even when entering single
user mode.
       This involves running sulogin when the machine enters run level
zero. Add the following to /etc/inittab:

    ~~:S:wait:/sbin/sulogin

This command tells init (the first process that starts when linux is
booted) to run the sulogin program automatically. sulogin prints the
following to your tty:

    Give root password for system maintenance
    (or type Control-D for normal startup):

If you know the root pw, you are dropped to a root shell. If not, then
sorry -- no root for you.

It's important to remember that this method handily prevents you from
entering your own system in single user mode if you forget the root
password! [1]


NOTES

[1] If sulogin determines that there is no usable root password in
/etc/shadow or /etc/passwd because the files have been horribly mangled,
then it will give you root access automatically because no valid
authentication is possible.

__________________________________________________________________

About the author(s)
-------------------
Brian Hatch is Chief Hacker at Onsight, Inc, and author of Hacking 
Linux Exposed and Building Linux VPNs. Brian can be reached at 
brian@xxxxxxxxxxxxxxxxxxxxxxx.
__________________________________________________________________

ADDITIONAL RESOURCES

Overview of Boot Prompt Arguments 
http://itw.itworld.com/GoNow/a14724a60491a76028222a3 

Booting in single user mode 
http://itw.itworld.com/GoNow/a14724a60491a76028222a7 

BSD Tricks: Unprepared Disaster Recovery
http://itw.itworld.com/GoNow/a14724a60491a76028222a2 

Single user mode changing root passwd ?
http://itw.itworld.com/GoNow/a14724a60491a76028222a1
___________________________________________________________________

ITWORLD.COM NEWSLETTER ARCHIVE

Index of Linux Security
http://itw.itworld.com/GoNow/a14724a60491a76028222a8

Sign Everything, My Friends
http://itw.itworld.com/GoNow/a14724a60491a76028222a5

Linux Goes a la Carte with UnitedLinux
http://itw.itworld.com/GoNow/a14724a60491a76028222a6
___________________________________________________________________

CUSTOMER SERVICE

SUBSCRIBE/UNSUBSCRIBE:
- Go to: http://www.itworld.com/newsletters
- Click on "View my newsletters" to log in and manage your account
- To subscribe, check the box next to the newsletter
- To unsubscribe, uncheck the box next to the newsletter 
- When finished, click submit

Questions? Please e-mail customer service at: mailto:support@xxxxxxxxxxx
____________________________________________________________________

CONTACTS

* Editorial: Andrew Santosusso, Newsletter Editor, 
  andrew_santosusso@xxxxxxxxxxx
* Advertising: Clare O'Brien, Vice President of Sales, 
  clare_obrien@xxxxxxxxxxx
* Career Corner: Janis Crowley, Vice President/General Manager, IDG 
  Recruitment Solutions, janis_crowley@xxxxxxxxxxxxx
* Other inquiries: Jodie Naze, Senior Product Marketing Manager, 
  jodie_naze@xxxxxxxxxxx

___________________________________________________________________

PRIVACY POLICY

ITworld.com has been TRUSTe certified 
http://www.itworld.com/Privacy/

Copyright 2002 ITworld.com, Inc., All Rights Reserved.
http://www.itworld.com



-- This is the discussion@xxxxxxxxx list.  To unsubscribe,
visit http://www.complete.org/cgi-bin/listargate-aclug.cgi