Re: [POSSIBLE GRAVE SECURITY HOLD]

[Samuel Tardieu <sam@debian.org>]

| Err, there is a mistake here somewhere. If you are getting 1FA at the
| boot
| prompt then lilo is *NOT* in the MBR. If it were you would get the lilo
| prompt.

Have you read my mail? If you install Debian with default settings, you will
have a MBR installed in the MBR, not lilo (lilo will be installed on your /
partition).

On the contrary with the MBR found on other systems (M$, *BSD, ...), this one
allows the user to press "shift" at boot time: instead of giving lilo a chance
to start, it will allow the user to boot on the floppy disk.

| OTOH, if you have physical access to the machine is there really any
| security?

Once again, reread my mail: our machines are physically secured, and the
chances that they are physically breaked in are very low (this would imply
breaking the whole box, and we have cameras and guards looking at them).
However, with this MBR in place, some students did manage to boot on a floppy
and this got unnoticed.