Please enable JavaScript.

Coggle requires JavaScript to display documents.

Linux Boot Password Reset Protection (Enterprise Level) - Coggle Diagram

- - - - Reboots Server
      - Edits GRUB Entry
      - Adds
        
        rd.break
        
        init=/bin/bash
        
        single
      - Boots Into Emergency Shell
      - Mounts Filesystem
      - Resets Root Password
      - Gains Full Control
  - - - Protection Layers
        
        BIOS / UEFI Security
        
        Purpose
        
        First line of defense before OS loads
        
        Prevent unauthorized boot changes
        
        Protect firmware settings
        
        Enterprise Implementation
        
        Set BIOS/UEFI Administrator Password
        
        Disable unauthorized boot devices
        
        Disable external boot (USB/DVD/PXE)
        
        Enable TPM 2.0
        
        Enable Secure Boot
        
        Keep firmware updated
        
        Verification
        
        Check BIOS settings during boot
        
        Verify TPM detection
        
        ls /dev/tpm*
        
        Interview Questions
        
        Why secure BIOS/UEFI?
        
        Prevent attackers from changing boot process
        
        Why disable USB boot?
        
        Prevent booting malicious OS
        
        Bootloader Security (GRUB2)
        
        Purpose
        
        Prevent unauthorized kernel modifications
        
        Protect single-user and recovery modes
        
        Enterprise Risks
        
        Root shell through GRUB editing
        
        Boot parameter manipulation
        
        Password reset attacks
        
        Implementation
        
        Create GRUB Password
        
        grub2-setpassword
        
        Ubuntu
        
        sudo grub-mkpasswd-pbkdf2
        
        Add superuser in GRUB
        
        sudo nano /etc/grub.d/40_custom
        
        Generate configuration
        
        sudo update-grub
        
        Verification
        
        Reboot system
        
        Attempt to edit GRUB entry
        
        Password prompt should appear
        
        Interview Questions
        
        Why secure GRUB?
        
        Prevent unauthorized root access during boot
        
        Root Account Security
        
        Purpose
        
        Protect highest privileged account
        
        Reduce attack surface
        
        Enterprise Best Practices
        
        Disable direct root login
        
        Use sudo instead of root login
        
        Enforce strong passwords
        
        Restrict SSH root access
        
        Monitor privilege escalation
        
        Implementation
        
        Lock root account
        
        sudo passwd -l root
        
        Disable SSH root login
        
        sudo nano /etc/ssh/sshd_config
        
        PermitRootLogin no
        
        Restart SSH
        
        sudo systemctl restart ssh
        
        Sudo Management
        
        sudo visudo
        
        Example
        
        %linux_admins ALL=(ALL) ALL
        
        Verification
        
        sudo -l
        
        Interview Questions
        
        Why disable root login?
        
        Improves accountability and auditing
        
        Why use sudo?
        
        Command-level privilege control
        
        Disk Encryption (LUKS)
        
        Purpose
        
        Protect data at rest
        
        Prevent offline data theft
        
        Enterprise Risks
        
        Stolen laptop
        
        Stolen hard disk
        
        Unauthorized VM access
        
        Implementation
        
        Install package
        
        sudo apt install cryptsetup
        
        Encrypt partition
        
        sudo cryptsetup luksFormat /dev/sdb1
        
        Open encrypted volume
        
        sudo cryptsetup open /dev/sdb1 secure_data
        
        Create filesystem
        
        sudo mkfs.ext4 /dev/mapper/secure_data
        
        Mount filesystem
        
        sudo mount /dev/mapper/secure_data /mnt
        
        Enterprise Features
        
        Multiple passphrases
        
        TPM integration
        
        Centralized key management
        
        Clevis and Tang
        
        HSM integration
        
        Verification
        
        sudo cryptsetup luksDump /dev/sdb1
        
        Interview Questions
        
        What does LUKS protect?
        
        Data at rest
        
        Does LUKS protect a running system?
        
        No
        
        Secure Boot
        
        Purpose
        
        Ensure trusted software loads during startup
        
        Prevent bootkits and rootkits
        
        How It Works
        
        Firmware verifies bootloader
        
        Bootloader verifies kernel
        
        Kernel verifies drivers
        
        Enterprise Implementation
        
        Enable Secure Boot in BIOS
        
        Use signed kernels
        
        Use signed drivers
        
        Enable TPM measurements
        
        Verification
        
        mokutil --sb-state
        
        Expected Output
        
        SecureBoot enabled
        
        Interview Questions
        
        What is Secure Boot?
        
        Chain of trust during boot
        
        What attacks does it prevent?
        
        Bootkits and rootkits
        
        Physical Security
        
        Purpose
        
        Prevent physical access attacks
        
        Enterprise Controls
        
        Locked server rooms
        
        Access card systems
        
        CCTV monitoring
        
        Rack locking
        
        Visitor management
        
        Asset tracking
        
        Data Center Security
        
        Biometric access
        
        Security guards
        
        Environmental monitoring
        
        Fire suppression systems
        
        Risks Mitigated
        
        Device theft
        
        USB attacks
        
        Hardware tampering
        
        Unauthorized access
        
        Interview Questions
        
        Why is physical security important?
        
        Physical access often bypasses software controls
        
        Monitoring And Auditing
        
        Purpose
        
        Detect security incidents
        
        Maintain compliance
        
        Track user activities
        
        Auditd
        
        Install
        
        sudo apt install auditd
        
        Service Status
        
        sudo systemctl status auditd
        
        View Logs
        
        sudo ausearch -ts today
        
        Logging
        
        rsyslog
        
        journald
        
        SIEM Integration
        
        Key Monitoring Areas
        
        Login attempts
        
        Sudo usage
        
        File modifications
        
        Service changes
        
        Privilege escalation
        
        Authentication failures
        
        Enterprise Tools
        
        Auditd
        
        Wazuh
        
        Elasticsearch
        
        Logstash
        
        Kibana
        
        Splunk
        
        QRadar
        
        Verification
        
        sudo auditctl -l
        
        Interview Questions
        
        Difference between monitoring and auditing?
        
        Monitoring = Real-time detection
        
        Auditing = Historical investigation
        
        Enterprise Defense Strategy
        
        Layer 1
        
        BIOS/UEFI Security
        
        Layer 2
        
        Secure Boot
        
        Layer 3
        
        GRUB Security
        
        Layer 4
        
        Root Account Security
        
        Layer 5
        
        Disk Encryption
        
        Layer 6
        
        Physical Security
        
        Layer 7
        
        Monitoring And Auditing
        
        Security Principle
        
        Defense In Depth
        
        Goal
        
        If one layer fails
        
        Other layers continue protecting the system
        
        Interview Summary
        
        BIOS Security
        
        Protect firmware settings
        
        GRUB Security
        
        Protect bootloader access
        
        Root Security
        
        Control privileged access
        
        LUKS
        
        Protect data at rest
        
        Secure Boot
        
        Verify trusted boot chain
        
        Physical Security
        
        Protect hardware access
        
        Monitoring And Auditing
        
        Detect and investigate attacks
        
        Defense In Depth
        
        Multiple security layers working together
  - - - Stop Unauthorized Boot Changes
      - Prevent Booting External Media
    - - Enter BIOS
      - Set Administrator Password
      - Set Boot Password
      - Disable USB Boot
      - Disable CD DVD Boot
      - Disable PXE Network Boot
      - Lock Boot Order
    - - Prevents Booting Kali Linux
      - Prevents Offline Password Reset Tools
      - Prevents Unauthorized OS Installation
  - - - Prevent Editing Boot Parameters
    - - grub2-install --version
    - - grub2-mkpasswd-pbkdf2
    - - grub.pbkdf2.sha512.xxxxxxxxx
    - - vi /etc/grub.d/40_custom
    - - set superusers="admin"
      - password_pbkdf2 admin grub.pbkdf2.sha512.xxxxxxxxx
    - - grub2-mkconfig -o /boot/grub2/grub.cfg
    - - update-grub
    - - Reboot Server
      - Press e On GRUB Entry
      - Password Prompt Appears
    - - Prevents Kernel Parameter Modification
      - Prevents rd.break Attack
      - Prevents init=/bin/bash Attack
  - - - Prevent Direct Root Shell Access
    - - systemctl status rescue.service
    - - systemctl edit rescue.service
    - - [Service]
      - ExecStart=
      - ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue
    - - systemctl daemon-reload
    - - systemctl rescue
    - - Requires Root Password
      - Blocks Unauthenticated Rescue Access
  - - - Reduce Root Abuse
    - - passwd -l root
    - - passwd -S root
    - - vi /etc/ssh/sshd_config
    - - PermitRootLogin no
    - - systemctl restart sshd
    - - Forces Named Accounts
      - Improves Accountability
  - - - LUKS
    - - Protect Data At Rest
      - Prevent Offline Password Reset
    - - cryptsetup luksFormat /dev/sdb
    - - cryptsetup luksOpen /dev/sdb secure_disk
    - - Data Unreadable Without Key
      - Protects Stolen Servers
      - Protects Virtual Machine Disks
    - - Use TPM
      - Use Clevis And Tang
      - Centralized Key Management
  - - - Prevent Unauthorized Bootloaders
    - - BIOS UEFI Settings
      - Enable Secure Boot
    - - Prevent Rootkits
      - Prevent Modified Kernels
      - Protect Boot Chain
  - - - Locked Server Racks
      - CCTV Monitoring
      - Security Guards
      - Biometric Access
      - Visitor Logging
    - - Prevent Physical Tampering
      - Prevent USB Attacks
  - - - Monitor Critical Files
      - auditctl -w /etc/passwd -p wa
      - auditctl -w /etc/shadow -p wa
      - auditctl -w /boot/grub2/grub.cfg -p wa
    - - ausearch -k passwd
      - ausearch -k grub
    - - ELK
      - Wazuh
      - Splunk
    - - Detect Unauthorized Changes
      - Generate Security Alerts
  - - - Boot Server
      - Edit GRUB
      - Add rd.break
      - Reset Root Password
    - - BIOS Password
      - GRUB Password
      - Secure Boot
      - LUKS Encryption
      - Physical Security
    - - Attack Fails
  - - - Because Physical Access Allows Kernel Parameter Modification
    - - Emergency Breakpoint Used To Obtain Root Shell Before Normal Boot
    - - Configure GRUB Password Using grub2-mkpasswd-pbkdf2
    - - Use LUKS Full Disk Encryption
    - - Physical Security Plus LUKS Encryption Plus GRUB Password
    - - GRUB Protects Bootloader Editing
      - LUKS Protects Data On Disk
    - - BIOS Password
      - GRUB Password
      - Secure Boot
      - LUKS Encryption
      - TPM
      - Clevis Tang
      - Auditd
      - SIEM Monitoring