XK0-005 · Question #805
Which of the following is a simple option to deter attackers who have physical access to a Linux system from performing a root account takeover?
The correct answer is A. Configuring a GRUB bootloader password. Setting a GRUB bootloader password prevents unauthorized users with physical access from manipulating boot options to gain root access or boot into single-user mode.
Question
Which of the following is a simple option to deter attackers who have physical access to a Linux system from performing a root account takeover?
Options
- AConfiguring a GRUB bootloader password
- BRemoving the root user from the system
- CPurchasing a hardware security module
- DDisabling the runlevel for single-user mode
How the community answered
(28 responses)- A89% (25)
- C4% (1)
- D7% (2)
Why each option
Setting a GRUB bootloader password prevents unauthorized users with physical access from manipulating boot options to gain root access or boot into single-user mode.
Configuring a GRUB bootloader password requires authentication before boot options can be edited or single-user mode can be accessed. This prevents an attacker with physical access from booting into a recovery shell or changing kernel parameters to gain root access without knowing the password.
Removing the root user from a Linux system is not feasible or recommended, as the root user is essential for system administration tasks.
While a Hardware Security Module (HSM) enhances security, it is a complex and expensive solution, not a 'simple option' to deter physical root takeover.
Disabling single-user mode runlevel can make system recovery difficult and might not completely prevent other methods of root access if the bootloader itself is unprotected.
Concept tested: GRUB bootloader security for physical access
Source: https://www.gnu.org/software/grub/manual/grub/html_node/Security.html
Topics
Community Discussion
No community discussion yet for this question.