Boot Loaders
Boot loaders are small programs that manage the boot process. If you've worked with Windows NT, you've had some experience with a boot loader. At startup, NT's boot loader asks what operating system you'd like to boot to.
In Linux, the most commonly used boot-loading tool is LILO, the Linux Loader. During installation (typically at the very end), Linux will generate LILO values and ask you to verify them. At that time, you are given the opportunity to insert additional LILO boot options. For example, perhaps you have additional partitions and operating systems you'd like to add. This way, during system startup you can choose which operating system to use for that session.
LILO reads its options from /etc/lilo.conf, the LILO configuration file. /etc/lilo.conf provides an option for a boot password. Let's quickly cover that now.
/etc/lilo.conf: The LILO Configuration File
After installation, your /etc/lilo.conf will contain values for boot images, target drives, and the root partition. Here's the /etc/lilo.conf from the drive partitioned in the preceding example:
# # general section # boot = /dev/hda install = /boot/boot.b message = /boot/message prompt # wait 20 seconds (200 10ths) for user to select the entry to load timeout = 200 # # default entry # image = /vmlinuz label = linux root = /dev/hda2 read-only # # additional entries #
Let's quickly familiarize you with /etc/lilo.conf and its contents. This way, when you edit it, you'll feel confident that you're making the right changes. Table 3.3 lists some commonly used options for /etc/lilo.conf.
Table 3.3 Commonly Used /etc/lilo.conf Options
|
Option |
Purpose |
|
append=[hardware-params] |
Use this option to specify additional hardware parameters. For example, you might want to specify the amount of RAM you have or your hard drive's precise geometry, which might not necessarily be auto-detected. |
|
backup=[backup-file] |
Use this option to prompt LILO to copy the boot sector to a backup file. |
|
boot=[boot-device] |
Use this option to specify the bootable partition. For example, in the sample /etc/lilo.conf, the boot device is /dev/hda (the first hard drive). |
|
delay=[time] |
Use this option to specify how long the boot loader should pause before booting, in tenths of a second. This is Linux's equivalent of Windows NT's STARTUP/SHUTDOWN pause setting. You can narrow this to nothing unless you intend to pass additional parameters at the boot: prompt. |
|
force-backup=[file] |
Use this option to back up the boot sector to a file and overwrite previous backups. |
|
install=[boot-sector] |
Use this option to install the specified file as the new boot sector. This is generally not required unless you want to specify a boot sector other than the default (/boot/boot.b). |
|
initrd=[ramdisk image] |
Some Linux users need to have a ramdisk containing drivers for their hardware (such as SCSI cards); this entry will be created automatically upon installation. It is very important that it not be removed if it exists. |
|
message=[message-file] |
Use this option to specify a message file, which contains the text message that appears above the boot: prompt at boot time. Usually, this is a note from the vendor or a message demanding additional boot arguments. However, you can make this anything you like. (I've seen some pretty goofy ones.) |
|
password=[password] |
Use this option to set a boot password. We'll cover this in just a moment. |
|
restricted |
Use this option to specify that a password is required only when users attempt to pass additional boot arguments. |
|
timeout=[time] |
Use this option to specify how many tenths of a second the boot loader should wait before booting without keyboard input. |
|
verbose=[level] |
Use this option to control how verbose boot messages are. I recommend the maximum, which is 5. |
Adding a Boot Password
To add a password to your /etc/lilo.conf, insert a line like this:
password=123456
This will prevent local users from booting Linux without a password. Note that the password will not be encrypted. Therefore, ensure that /etc/lilo.conf is owned by root and set to mode 600. If you don't, malicious users can later obtain your LILO password.
NOTE
If you intend to automate reboots as part of some administrative procedure, you'll have to pass on the LILO PASSWORD option. If you do enable the PASSWORD option, Linux will arrest the reboot until an operator enters a password.
Summary of Boot Loaders
You might later decide not to use LILO. After all, it's not the only boot manager out there. Consult your boot loader documentation to see whether it also supports password protection. Every layer counts.
And finally, note that the /etc/lilo.conf password option does not prevent attackers from booting with a floppy. If your BIOS/PROM offers an option to disable floppy diskette boots, use it.
NOTE
Another option is to install LILO to floppy. This way, attackers can't boot Linux from the hard drive unless they have a boot disk and can guess your disk layout. If you take this approach, be sure to make several copies of your LILO boot disk, just in case your original gets corrupted.