Say someone gains physical access to my computer, and they want to login to my account and see everything I have. Is it possible that they take the hard-drive out of my computer, modify the file /etc/shadow with a new password, and then use it to login?In other words, does the Linux password change by simply modifying /etc/shadow?(All this assuming that there's no HD volume-encryption involved)
Physically override linux credentials
linux;security;password;pam;passwd
Once they have the hard disk drive they hardly need your password. They simply mount all partitions according to (your) /etc/fstab. The next step is sudo su - your account id (if your id is 501, just sudo su - 501).Short on using encrypted disk with a good password and all, there is little if any you can do to make your data safe.This little include:Do not use plain text password in scripts (for instance a cron job collecting email (...=pop(me@google.com,avreyclverpassword), access to remote hosts, etc.)Do not use password-less gpg and ssh keys. (Re-type them each time or use an agent to store them in memory.)