Locking it down cold

C

Coldblackice

[H]ard|Gawd
Joined
Aug 14, 2010
Messages
1,152
What are some of the most common ways that the average home user might employ to get around restrictions?


I'm trying to lock down a machine from any lascivious "love-watching", but it's been a while since I've had any dealings with machine restrictions.

So far, I've installed K9 (by no means perfect, of course). I've also contemplated a DNS-based protection like OpenDNS FamilyShield. I plan to disable Windows safemode, as well.

This isn't for anything employment related, and is by no means "mission critical" -- so I'm not too worried about locking it up with Knox-grade restrictions :) I'm just looking for some of the most common/likely holes that the average home user might use to get around restrictions.


As for locking down the user's ability to install programs -- if this could somehow be remotely unlocked on a per-instance basis (using Windows 7), that would be great. I imagine that, short of using a fully managed domain server, it's not feasible. And I'd rather not have to physically drop in on the machine each time something needed to be installed.

...On that note, however, I suppose that could be done as simply as through a VNC server/client. Duh.

VPN is always a restriction-bypassing threat, of course. How might one go about blocking VPN access, whether through the machine or at the router level?
 
Install Teamviewer in server mode so you can remote into the machine.

Set it up with an Admin account that only you know the pw to

Setup the user as a standard user

If you have to, you can reboot the machine / login as Admin /etc .

If you want to go extreme at least
 
rsbennett00 said:
Did you change bios so it only boots from the HD and then password bios?
Click to expand...

Yes, I did -- thanks for the mention.

I wondered, however, if this was circumventable with the ability to "escape" the boot order during POST. (It's not my motherboard, so I'm not sure if that feature is lockable)


I tried to disable the extraneous SATA ports to stop any extra drives from being attached, but realized it was fruitless as any new drive could be swapped into the primary/main SATA port.

Is there any way to "lock" a specific drive to a specific BIOS/port? Sort of like how Microsoft detects whether enough of the system components have changed to warrant a need for a new registration key.


stiltner said:
Install Teamviewer in server mode so you can remote into the machine.

Set it up with an Admin account that only you know the pw to

Setup the user as a standard user

If you have to, you can reboot the machine / login as Admin /etc .

If you want to go extreme at least
Click to expand...

Good ideas, thanks. I contemplated locking the system down entirely through the BIOS -- not just an administrator password to enter the BIOS settings, but also enabling a password to even boot the machine.

This would work fine if the user kept their machine running all the time (they do not). Would waking the machine up from sleep require the BIOS boot password again? I imagine resuming from hibernation would, given that it's a full power-down, but I'm fuzzy as to whether a resume from sleep would have to run through POST (and thus, the BIOS boot security).
 
Not sure but I think with a warm boot it won't ask for BIOS password till its cold booted. But I could be wrong
 
stiltner said:
Not sure but I think with a warm boot it won't ask for BIOS password till its cold booted. But I could be wrong
Click to expand...

I guess I'll just have to try it out. It would be most ideal if that is the case -- that way, the user can still power down the machine (so to speak), but won't be able to fully shut down or reboot without authority intervention to enter the BIOS password. This would prevent booting to new drives, safemode, etc.
 
I've seen some motherboards with administrator passwords require passwords for the boot menu, others do not. I think it sorta circumvents the system when you allow people to use boot disc on a password locked system without the password :D
 
You must log in or register to reply here.
Back
Top