Reminder: Physical access = Root access

Today I needed to reset a password on an Ubuntu system. While doing this, I was reminded of just how simple it is to get root access on a default install of Ubuntu. I wanted to share these steps on this blog to remind people that if someone has physical access to your Ubuntu system, they can get root access in just a few seconds.

• Boot up your computer
  
• When asked, hit "Escape" to enter the GRUB menu
• Select the option that displays "recovery mode"
• Select the option labeled "root prompt"
• You are now logged in as root with the ability to change anything
  

It is really just that simple. This root console is great for advanced users who need to reset a password, but the average user will have no idea what to do. For instance, here is how I found the main user of this system:

root@laptop:~# cat /etc/passwd | grep 1000:1000
tristan:x:1000:1000:Tristan Rhodes,,,:/home/tristan:/bin/bash

This output shows that there is a user named "tristan" who is the main user of this system. Next I needed to reset the password for that user. So I entered this command:

root@laptop:~# passwd tristan
Enter new UNIX password:
Retype new UNIX password:
passwd: password updated successfully
root@laptop:~#

Next I was able to reboot the system and login as "tristan" using the new password I created.

Can this process be improved?

Like I mentioned above, the root command prompt is not the most user friendly interface ever invented. At best, it is confusing to new users and at worst it is very dangerous. So how can this be improved? Well there are already some great ideas floating about, and thanks to the powerful Ubuntu Brainstorm website you can see what people have said about this topic. One of the more popular ideas is a Graphical Recovery Mode. If you want to help make Ubuntu better, please vote on the ideas you want to see implemented or even post your own ideas on the Ubuntu Brainstorm website.

Is there any way to prevent root access?

Many people may choose to give up the simple password recovery in the interest of securing their system. There are many different ways to do this including:

• Use a BIOS password that prevents the computer from booting
• Use a GRUB menu password that prevents the computer from booting
• Use an encrypted file-system that requires a password to use

I'm sure there are other ways to do this, so please provide your input in the comments below.