0

I want to work on tails without admin passwd, but i do want to config my torrc file and a proxychain. I want to do this without leaving traces on my usbstick (like customized torrc file). Is it possible to disable adminpassword after booting with admin password?

If no, is it possible to customize tails like:removing admin privileges on the torrc file so I can edit the torrc file without admin password. As second: fix an preinstalled Proxychains 3.1 on my tails usb?

btw: im not using the tails installed from tails (no encrypted volume etc). So things are maybe different from the real live USB

Please no stupid questions why I want this, I just want this.

  • I found this: If you want to disable root account in ubuntu you need to lock the root account by using the following command $sudo passwd -l root – Peter Appel Nov 27 '17 at 2:59
  • This seems to work but is it really as safe as disable adminpassw from boot? It now can prevent an attacker with physical or remote access to your Tails system to gain administration privileges and perform administration tasks against your will. – Peter Appel Nov 27 '17 at 3:05
  • Locking the root account is probably not sufficient. – cacahuatl Nov 28 '17 at 2:21
0

Basically, the amnesia user has been added to the sudoers list. This allow the amnesia user to execute commands as root.

This is defined by the file /etc/sudoers.d/tails-greeter.

Executing sudo passwd -l root is not sufficient to stop the amnesia user to from executing sudo -i and gaining a shell as the root user. It would simply stop logging in directly as the root user. Removing the file /etc/sudoers.d/tails-greeter will remove the ability for amnesia to execute arbitrary commands as root.

To answer your other ideas:

removing admin privileges on the torrc file so I can edit the torrc file without admin password.

This allows non-admin users to violate Tails' packet filtering and should never happen and is also a potential path to arbitrary code execution as root, this is worse than sudo since it is not protected by a password.

I want to do this without leaving traces on my usbstick

You cannot customize Tails without leaving a trace of the customization on the USB stick. You can create a customized version of Tails but it will be obvious that it is non-standard, and in what ways it is non-standard, to anyone who can read the contents of the USB stick.

  • You are the boss. In a case im running my own tornodes but dont want them get hijacked and get dirty codes implented there, I can also remove everyone from sudo + disabling root account to make this impossible to do? I dont mind about losing access to the root/sudo. – Peter Appel Dec 2 '17 at 3:15
  • To come back on what you said, after I disable the root account as amnesia, I cannot edit any files like the torcc file again. If im right I cannot execute sudo's with amnesia after disabling. I asked tails support the same question but they told me in a rush that they didnt see any security issues, next to that applications like tails upgrader probably wont work. After disabling amnesia as sudoer tails is as secure aiganst attacks as when I boot without administration password? – Peter Appel Dec 2 '17 at 3:26
  • Disabling sudo for amnesia (amnesia still has some sudo capabilities if you remove that file, like it can still get the debugging info for whisperback) it just stops amensia from running any program as root, only a specific subset of commands, to see what is allowed for your user you can run sudo -l so the upgrader, etc should still work if you just remove the file I pointed to under /etc/sudoers.d/. It's not as secure as never allowing amnesia root, and it doesn't stop other privesc or kernel exploits but it stops a much easier path to root being accessible to malicious software – cacahuatl Dec 2 '17 at 19:22
  • Is there any way to connect you? Maybe you could help me to still get the system almost as safe as when booting without root. I'm able to pay for it – Peter Appel Dec 4 '17 at 1:15
  • I also have some more things on tails that I want to realize, information is worth gold, so everything paid. – Peter Appel Dec 4 '17 at 1:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.