1

If I forget my password to my Raspberry Pi, I can gain access again by using single user mode (here is an alternative link). The upside is that if I don't know my password, I can gain access. The downside is that if anyone doesn't know my password they can gain access.

Is it possible to prevent unauthorized access via single user mode?

As far as I have researched, the answer is no. I write to ask this question in the hope that either:

  1. You can show me that I am wrong and that it is possible to disable single user mode; or
  2. I can achieve my end goal (security of my user data) via some other means, even though any nefarious actors that gain physical access to my Raspberry Pi will be able to gain sudo access.
4

Put the data you're trying to protect on a separate partition and encrypt it. Typical users will want to encrypt /home. You could also encrypt the root partition itself, though that will be more difficult to set up and maintain.

On an encrypted machine, the person who gains physical access will only be able to see the unencrypted data. In case of root partition encryption, the only thing they will be able to see from single-user mode is the initramfs.

Note that with physical access it will still be possible to destroy your data. There's no way around that: worst case, one can always smash your Pi with a hammer.

1
  • 1
    "no way around that", but that risk is mitigated by keeping a current backup in a remote location. – Seamus Oct 21 '20 at 20:57
1

This is IMPOSSIBLE.

If others have physical access to the system there is nothing you can do to prevent access.
This pretty much applies to all computer systems.

The access (more commonly referred to as a root shell) gives access to everything (unless it is encrypted).

Others have resorted to extreme measures e.g. glueing the SD Card in the Pi - this means, it ever it fails the Pi is inaccessible.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.