Re: How can I prevent users from mounting FAT32 partition?
Juha Kustaa Siltala wrote:
> In article <y6acnf1xp9jJXpCiXTWQlg@giganews.com>, Mark Cudworth wrote:
>
>>"Fool" <fool@tom.com> writes:
>>
>>>I fear that a hacker would gain admin rights in my computer.
>>>Then he can amend the configuration to allow him to mount the partition.
>>>Can I disallow all users, including root, to mount the partition?
>>
>>If you don't mind preventing anyone from mounting the partition, recompile
>>your kernel without support for FAT32 file systems. (Don't even include
>>support as a module.) This won't prevent the committed cracker from
>>seeing the data on the partition if he/she has root access, but they won't
>>be able to *mount* the partition and it will be much more difficult. Make
>>sure they can't install a new kernel and reboot remotely.
>
>
> Reading unmounted FAT32 is very hard to do (or at least that's what I
> think :)), most crackers are not very smart.
You're on very thin ice there. :^)
Of all the standard RW filesystems, FAT32 is probably the easiest
to read with a hex editor. Especially if it has been defragmented
recently.
Even if you don't know anything about the filesystem at all, just
try the command below for a laugh.
> strings /dev/hda
Kind regards,
Iwo
|