Score:0

Prevent standard user from changing encryption passphrase

in flag
Bob

How do I prevent non root attempts by local user to change whole disk encryption passphrase of actual system in Ubuntu 20.04TLS.

Note that I removed my account from the sudoers list then restarted and yet there is no prompt for for root password.

The system is installed on an SD card.

user10489 avatar
in flag
Which encryption passphase?
Bob avatar
in flag
Bob
System whole disk encryption
user10489 avatar
in flag
And what testing did you do to determine that a non-root user can change that passphrase?
heynnema avatar
ru flag
Does the user have physical access to the computer? Lock out the user's account. Start comments to me with @heynnema or I'll miss them.
Bob avatar
in flag
Bob
@heynnema Yes I want to block physical user access to change the encryption password using the graphical app Disks without locking local user account.
heynnema avatar
ru flag
Is the user account an admin account with sudo access?
Bob avatar
in flag
Bob
@heynnema I removed my account from the sudoers list and yet there's no prompt for root password, and I can change the passphrase without password. I think I have to block the script to be executed by root only still I don't know exactly what script and I don't want to break the system. Do you have an idea how I can do so ? Or if there is another solution for the issue ?
heynnema avatar
ru flag
Did you set a root password? I don't know how to help any further. Hopefully somebody else will chime in with a better solution.
user10489 avatar
in flag
Check contents of /etc/sudoers and /etc/sudoers.d/ to see if your user is configured to sudo without a password.
Bob avatar
in flag
Bob
@user10489 the local user is denied sudo privileges, when I try to unlock the SATA HARD DRIVE where my other system :Debian is installed it does ask for password but when I try to change the passphrase on the SD card where my active system is installed it doesn't ask for password.
Bob avatar
in flag
Bob
So I think it's I have to activate password protection for the SD card.
user10489 avatar
in flag
What is the exact command you are using that you are using to change the disk password?
mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.