Passwords serve as the primary security measure across various systems, including Linux, where the root password grants full control over the system. They are essential for securing BIOS, login, disks, applications, and more.

Linux is widely regarded as one of the most secure operating systems against hacking or cracking. Nonetheless, this article will explore some vulnerabilities and exploits specific to Linux systems.

We will use RHEL Linux as a case study to examine and test our own system's security.

Disclaimer: This information is provided for educational purposes only. Unauthorized access to computer systems is both illegal and unethical. Always ensure you have permission before conducting any security testing on systems. How to Access a Linux Server Without Root Access

When starting the Linux machine, press any key to interrupt the boot process, which will display the GRUB menu.

Press 'e' to edit and locate the line starting with kernel, then append 'rd.break‘ at the end of the line (after the blank space) to force the system into emergency user mode, preventing it from entering the default run-level.

After adding 'rd.break‘, press Ctrl X or F10 to boot with the modified kernel options into emergency user mode.

Once in emergency user mode, you will be dropped to a root shell prompt, where you must remount the root filesystem in read-write mode and enter the sysroot environment.

<code>mount -o remount,rw /sysroot
chroot /sysroot</code>

Then, use the passwd command to reset and confirm the new root password.

<code>passwd</code>

If the passwd command does not work and you receive no output, it indicates that SELinux is in enforcing mode. You must first disable it before proceeding.

<code>setenforce 0</code>

Then, run the passwd command again to change the root password.

<code>passwd</code>

At this point, you have successfully reset the root user password. The final step is to relabel all files with the correct SELinux contexts.

<code>touch /.autorelabel</code>

Finally, type exit and log out to initiate the SELinux relabelling process.

<code>exit</code>

This process usually takes a few minutes, and upon completion, the system will reboot and prompt you to log in as the root user with the new password.

Gaining access to a Linux system was surprisingly straightforward, wasn’t it? Consider the implications if someone did this to your server. Now, let's explore how to safeguard our Linux machine from unauthorized modifications in single-user mode.

Password Protecting Single User Mode in Linux

To safeguard Single User Mode with a password, specific configurations must be adjusted to thwart unauthorized access, which is crucial for system security, as Single User Mode can grant unrestricted root access.

To implement password protection in Single User Mode, you must modify the rescue.service file.

<code>sudo vi /usr/lib/systemd/system/rescue.service</code>

Find the line beginning with ExecStart. If it does not include the sulogin command, you will need to add or alter it to look like this.

<code>ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue</code>

After making these changes, it's vital to confirm the configuration is correct.

<code>grep sulogin /usr/lib/systemd/system/rescue.service</code>

The output should verify that the sulogin command is present in the ExecStart line.

Once the configuration is set, reboot the system to apply the changes. After rebooting, try entering Single User Mode to ensure the password prompt appears.

Hacking Your Linux System Without Using Single User Mode

You might feel reassured knowing your system is now more secure. However, this is only partially true. While it's harder to compromise your Linux system using single-user mode, other methods still exist.

In the previous method, we modified the kernel to enter single-user mode. This time, we'll edit the kernel with a different parameter.

Previously, we added the parameter 1 to the kernel to enter single-user mode, but now, we will add init=/bin/bash to boot directly into a bash prompt.

Once again, you've gained access to your system, and the prompt confirms the successful hack.

When attempting to change the root password using the same process as the first method with the passwd command, you encounter the following issue.

The problem is that the root (/) partition is mounted as read-only, preventing the password change from being saved. The solution is to remount the root (/) partition with read-write permissions.

<code>mount -o remount,rw /
passwd</code>

Now, try to change the root password using the passwd command again.

Congratulations! You've successfully accessed your Linux system once more. While it may seem easy to exploit, proper configuration can significantly enhance system security.

Password Protecting the GRUB Bootloader

Both methods described involved modifying and passing parameters to the kernel. To bolster the security of your Linux system and make it harder to compromise, you should prevent kernel modifications at boot.

This can be achieved by setting a password for the boot loader, specifically GRUB (note that LILO is another boot loader for Linux, but it will not be discussed here).

To password-protect the GRUB bootloader, you need to generate an encrypted password using the following command.

<code>grub2-mkpasswd-pbkdf2</code>

Next, edit the custom GRUB menu configuration file.

<code>vi /etc/grub.d/40_custom</code>

Add the following lines, replacing &ltencrypted_password> with the encrypted password generated earlier.

<code>set superusers="root"
password_pbkdf2 root &ltencrypted_password></code>

Update the GRUB configuration by running:

<code>grub2-mkconfig -o /boot/grub2/grub.cfg</code>

Reboot the system and, during the boot process, press 'e' to edit the GRUB menu. You will be prompted to enter the username (root) and the password you set earlier.

If you enter the correct password, you will be able to proceed with editing the GRUB parameters.

You might feel confident that your system is now fully secure and resistant to hacking, but the challenge is not over yet.

Remember, you can still enforce rescue mode to remove and modify the password using a bootable image.

Simply insert your installation CD/DVD into the drive and select Rescue Installed System or use any other rescue image, including a Live Linux Distro, mount the HDD, and edit the ‘40_custom‘ file to remove the password line, then reboot, and you will be logged in again.

Conclusion

This guide aims to educate you on these facts and provide guidance on securing your system. Tecmint.com and the author of this article strongly advise against using this guide to exploit others' systems.

The reader is solely responsible for any such actions, and neither the author nor Tecmint.com will be held accountable.

Your positive feedback is greatly appreciated and encourages us, and we always welcome it. Enjoy and Stay Tuned.

The above is the detailed content of How to Hack Your Own Linux System to Strengthen Security. For more information, please follow other related articles on the PHP Chinese website!