simple add to admin group

[Jim Richardson]

On Thu, 2005-09-29 at 10:33 +0200, R.L. Reingard wrote:
> hi all
> yesterday i fixed the 'sudoers disaster' simply by:
> 
> picking the "recovery mode"
> AND putting my user back to the admin group:
> $ adduser username admin
> 
> eventhough i like the fact, that i was able to fix the 'sudoers disaster'  
> so quickly, i question myself now:
> 
> someone knowing the password of a simple user (one not in the  
> sudoers-list) could start up the machine in 'recovery mode' and add that  
> user by the same command to the admin group (the admin group, which has by  
> default sudo rights).
> 
> is that nice?
> what be glad if we can talk on that.
> regards,
> René
> 

once you lose physical control of the machine, it is no longer
considered secure. Sure, a user could take the steps you mention, or
simply boot a knoppix LiveCD and make the password anything they want.
Without physical security, you cannot consider the system secure. 


-- 
Jim Richardson http://www.eskimo.com/~warlock
Another name for a Windows tutorial is crash course!
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
URL: <https://lists.ubuntu.com/archives/ubuntu-users/attachments/20051002/681e7022/attachment.sig>