0

I want to work on tails without admin passwd, but i do want to config my torrc file and a proxychain. I want to do this without leaving traces on my usbstick (like customized torrc file). Is it possible to disable adminpassword after booting with admin password?

If no, is it possible to customize tails like:removing admin privileges on the torrc file so I can edit the torrc file without admin password. As second: fix an preinstalled Proxychains 3.1 on my tails usb?

btw: im not using the tails installed from tails (no encrypted volume etc). So things are maybe different from the real live USB

Please no stupid questions why I want this, I just want this.

3
  • I found this: If you want to disable root account in ubuntu you need to lock the root account by using the following command $sudo passwd -l root Nov 27, 2017 at 2:59
  • This seems to work but is it really as safe as disable adminpassw from boot? It now can prevent an attacker with physical or remote access to your Tails system to gain administration privileges and perform administration tasks against your will. Nov 27, 2017 at 3:05
  • Locking the root account is probably not sufficient.
    – cacahuatl
    Nov 28, 2017 at 2:21

1 Answer 1

0

Basically, the amnesia user has been added to the sudoers list. This allow the amnesia user to execute commands as root.

This is defined by the file /etc/sudoers.d/tails-greeter.

Executing sudo passwd -l root is not sufficient to stop the amnesia user to from executing sudo -i and gaining a shell as the root user. It would simply stop logging in directly as the root user. Removing the file /etc/sudoers.d/tails-greeter will remove the ability for amnesia to execute arbitrary commands as root.

To answer your other ideas:

removing admin privileges on the torrc file so I can edit the torrc file without admin password.

This allows non-admin users to violate Tails' packet filtering and should never happen and is also a potential path to arbitrary code execution as root, this is worse than sudo since it is not protected by a password.

I want to do this without leaving traces on my usbstick

You cannot customize Tails without leaving a trace of the customization on the USB stick. You can create a customized version of Tails but it will be obvious that it is non-standard, and in what ways it is non-standard, to anyone who can read the contents of the USB stick.

10
  • You are the boss. In a case im running my own tornodes but dont want them get hijacked and get dirty codes implented there, I can also remove everyone from sudo + disabling root account to make this impossible to do? I dont mind about losing access to the root/sudo. Dec 2, 2017 at 3:15
  • To come back on what you said, after I disable the root account as amnesia, I cannot edit any files like the torcc file again. If im right I cannot execute sudo's with amnesia after disabling. I asked tails support the same question but they told me in a rush that they didnt see any security issues, next to that applications like tails upgrader probably wont work. After disabling amnesia as sudoer tails is as secure aiganst attacks as when I boot without administration password? Dec 2, 2017 at 3:26
  • Disabling sudo for amnesia (amnesia still has some sudo capabilities if you remove that file, like it can still get the debugging info for whisperback) it just stops amensia from running any program as root, only a specific subset of commands, to see what is allowed for your user you can run sudo -l so the upgrader, etc should still work if you just remove the file I pointed to under /etc/sudoers.d/. It's not as secure as never allowing amnesia root, and it doesn't stop other privesc or kernel exploits but it stops a much easier path to root being accessible to malicious software
    – cacahuatl
    Dec 2, 2017 at 19:22
  • Is there any way to connect you? Maybe you could help me to still get the system almost as safe as when booting without root. I'm able to pay for it Dec 4, 2017 at 1:15
  • I also have some more things on tails that I want to realize, information is worth gold, so everything paid. Dec 4, 2017 at 1:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .