Security concerns related to agetty autologin options

medicineman25 · 2019-01-01 02:48:17

I've configured my system with LUKS on LVM (and encrypted boot), then getty autologin which triggers autostart for startx, which then launches openbox-session.

For autologin, I have used the options covered in this wiki:

https://wiki.archlinux.org/index.php/Ge … al_console

I am just curious about the security of this option. More specifically, if someone gets access to my system through a network, are they able to autologin to tty1 whilst the machine is operating?

I have also taken other measures to ensure that only one virtual console is opened and a max of one session available. Details covered here (except the session option, which is in the same file as # of auto-generated VT consoles):

https://wiki.archlinux.org/index.php/ge … l_consoles

Assuming that this would be a fairly obvious security hole (if it were in fact a threat), it would be noted on the wiki with a warning. However, to assume would make an ass out of you and me.

Just a note, I will also be running expressvpn prior to any network connections, so I'm probably being a tad paranoid but I thought I would ask the question either way. If for nothing else, than for learning purposes.

I would be very grateful for any advice or knowledge on this topic.

EDIT: Further, I will obviously be reading the Security Hardening page on ArchWiki, and my boot is only accessible with a passphrase and master key stored on a flash disk.

Regards,

MM25

Last edited by medicineman25 (2019-01-01 02:57:51)

jasonwryan · 2019-01-01 03:19:21

medicineman25 wrote:

if someone gets access to my system through a network

If this happens, you are toast, irrespective if they can autologin. Just make sure you are the only person that access the machine over the network.

medicineman25 · 2019-01-01 04:17:28

jasonwryan wrote:

medicineman25 wrote:
if someone gets access to my system through a network
If this happens, you are toast, irrespective if they can autologin. Just make sure you are the only person that access the machine over the network.

yeh definitely, that's what I was thinking... just wanted to make sure I wasn't doing a stupid.

As always, I appreciate your input

Trilby · 2019-01-01 04:46:49

To build on that, what would it mean to "get access to" your system through a network? Generally that would mean being able to login. If they've overcome the hurdle of login in, autologin wouldn't really further enable them. But aside from that, tty1 is a physical tty at the machine, remote logins are not given physical ttys.

medicineman25 · 2019-01-01 06:32:39

Trilby wrote:

To build on that, what would it mean to "get access to" your system through a network? Generally that would mean being able to login. If they've overcome the hurdle of login in, autologin wouldn't really further enable them. But aside from that, tty1 is a physical tty at the machine, remote logins are not given physical ttys.

Tbh I'm not sure what I meant, I just wasn't sure if this was a gaping hole in my security. I think you've clarified my concerns that tty1 is a physical tty and wouldn't be accessible from the network.

Either way, I've just spent the better part of a day learning about libreboot and Intel's PME / AMD's PSP. So I guess it doesn't really matter what I do atm, until I get off Intel based hardware I'm living on a backdoor.

seth · 2019-01-01 09:00:33

Your BIOS might offer to disable AMT and you can check for it: https://aur.archlinux.org/packages/mei-amt-check-git/

On your original question: TTY autologin does NOT result in "I can ping you, so I'm logged in immediately", but if you're paranoid™ you should not use it and likewise encrypt the installation and seal t he case (to mitigate local attacks) as well as at least PW lock the BIOS and prevent booting external drives (usb, dvd) - but let's be real: if the TLA (thre letter agency) *really* wants to intrude your system, they will get local access and manipulate the HW. Mobsters have another, much cheaper and more straight forward approach to extract informations out of you…

Arch Linux

#1 2019-01-01 02:48:17

Security concerns related to agetty autologin options

#2 2019-01-01 03:19:21

Re: Security concerns related to agetty autologin options

#3 2019-01-01 04:17:28

Re: Security concerns related to agetty autologin options

#4 2019-01-01 04:46:49

Re: Security concerns related to agetty autologin options

#5 2019-01-01 06:32:39

Re: Security concerns related to agetty autologin options

#6 2019-01-01 09:00:33

Re: Security concerns related to agetty autologin options

Board footer