The recent stable releases (at least 2.0, 2.1 and soon-to-be-released 2.2 -- Hamm, Slink and Potato) of the Debian Linux distributions use a dangerous MBR in their default installation. Maybe this applies to older releases as well but I haven't been able to check these. When the SHIFT key is pressed during the boot, the installed MBR displays the string "1FA:" then waits for a keypress. It then boots a floppy if the F key is pressed, bypassing any security measures. This happens: - regardless of the BIOS configuration (even with floppy boot disabled and password-protected configuration). - regardless of Lilo (or other) configuration: this happens before Lilo is even started, so putting a password on Lilo is of no use. Since this MBR is installed by default during the installation (unless the user chooses to keep the previous MBR, which is not the natural choice for an installation from scratch, and is not the default choice anyway), many sites are probably vulnerable even though they have taken the usual steps to prevent tampering with the boot process. Quick fix: use Lilo's MBR by putting "boot=/dev/hda" (or equivalent) instead of "boot=/dev/hda1" in your Lilo configuration to install a barebones MBR. Thanks to Patrice Piétu <Patrice.Pietuat_private>, Thomas Quinot <Thomas.Quinotat_private> and Samuel Tardieu <Samuel.Tardieuat_private> for their help in tracking down the source of this problem and finding a fix. [ Note: this has been registered as Debian bug ID 56821, but has just been downgraded as a mere "wishlist" item, so clearly it is not given the attention it deserves. ] -- Pierre Beyssac pbat_private
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 15:32:59 PDT