Alright, seriously, I know there’s a zillion ways to compromise a box, but do we have to hand people the keys and tell them to go have fun? Here’s today’s bitching session, hold tight:
So I just installed Ubuntu 9.10 on my eee again, I thought I’d give it another shot, I can be a little harsh on Ubuntu and I like to get a fair and balanced view of things, so I decided to see what’s GOOD about Ubuntu. That didn’t last long. I’d also installed a Ubuntu 9.10 VM, and someone in an IRC channel asked a question about where a certain thing was in Ubuntu, I gave an answer and booted the VM to verify it. All is well so far, the VM still works, VMWare Tools still works, Ubuntu’s still working, great.
Unfortunately, I’d given my VM’s user account a password so obscure that even I couldn’t remember it, so I set about trying to get myself back in. I did, and this is where things start to get a little less fun. See, to fix a forgotten password on Ubuntu, what you have to do is boot to the recovery console, handily placed on the GRUB menu where it’s nice and easy to find, and do your thang. Perfect for someone who’s forgotten their password, like myself in a fit of dumbassery, not so perfect for anyone who wants a somewhat less insecure system, because it turns out that in the recovery console (again, easily accessible from GRUB) requires no authentication whatsoever. Now, that means not only that you could screw a system royally using it, YOU CAN ALSO CHANGE BOTH USER AND ROOT PASSWORDS WITH NO AUTHENTICATION. Yes, let me say that again, you can jump into recovery console with no more difficulty than pressing the down key and then Return at the GRUB menu and you can change the passwords on the system to just about anything you feel like. This is default behaviour and is absolutely attrocious from a security perspective.
Allow me to use an analogy, I’m aware that you could use a boot CD/USB or other 3rd party tool to smash the security in Ubuntu (or indeed many OSs and distros, Linux or otherwise) but that’s akin to walking up to a front door with a lockpick, a situation which requires an extra tool that most people don’t have. However, recovery console on the other hand, that’s like leaving the key under the front door mat. Not the brightest of ideas, it’s useful if you lose your key or lock yourself out, but it also means that if a casual opportunist happens to check under your doormat, a common place for a key to be hiding perhaps, they can let themselves in and do just about anything they feel like. Worse still, a fresh install of Ubuntu to a less experienced user is like buying a new house, except the previous owner left the spare key under the doormat and didn’t tell the buyer. Now the new owner has no idea that there’s a key under the doormat unless they were savvy enough to check, but anyone who knows that key is under the doormat can go explore the house as they wish.
Arguments against this problem, such as the argument that it doesn’t matter anyway because someone might still break in if they’re determined or experienced enough, are invalid. Why? Well, why bother having passwords at all? It might not keep Dr Hackerman out, but it’ll probably keep your family, friends and casual passers by out. Security is layered, what might not keep the big, bad superhacker out might still be enough to put your machine just above the low-hanging fruit. Yes, I admit that a simple password isn’t going to magically make your computer inpenetrable, but every little helps. Frankly this is only one step away from having a button on the login screen saying “I don’t have the password but let me in anyway, I won’t do any harm”.
Apparently it’s been debated on the Ubuntu forums, in the IRC, on Launchpad, etc, but ultimately it’s remained a design decision (much like the others I’ve come to despise) rather than a bug as it should rather be. This is stupid. All the problems I’ve had with Ubuntu are “design decisions”, they’re not “features instead of bugs” because that’s a funny thing to say and it’s being worked on, they are real “features”, period. Drivers, security, UI, all have serious flaws because some useless bastard said “nah, it’s alright, we’ll do it this way”. BUCK IT UP, CANONICAL. Fucking seriously. If Ubuntu is ever going to be a serious contender in my eyes, it needs some serious restructuring, some serious direction, a lot of people working in the same damn direction (and not an arbitrary direction) with some idea of how things are supposed to work rather than how they think stuff should work, and it needs to take itself a lot more goddamn seriously. All these little things add up, the more I’ve seen of Ubuntu the less I see it as any more than a complete and utter joke.
Pathetic.
Here’s a nice, handy guide on how to break into recover an Ubuntu box.
Gah.
EDIT: It’s come to my attention that if root is enabled (which it’s not on Ubuntu by default, and users aren’t supposed to enable it), recovery console will indeed prompt for a password. That still doesn’t make me feel much better.
