[gentoo-user] Locked desktop session but still running computer

[gentoo-user] Locked desktop session but still running computer

[whiteman808]

Hello,

I have a possibly stupid question motivated by curiosity. Is it possible to gain access to root account, or maybe at least have an access to regular user console, or even unlock desktop session without knowing password of root or regular user's password? How this can be done? I'm talking about computer not having any remote services like ssh exposed, even in lan

What should I do if for example I forgot hypothetically luks encryption password but still have computer powered on and locked gnome or kde session?

What in case if PC doesn't have enabled magic sysrq?

Just asking because I'm curious, not because I have problem described
above

Thank you,
whiteman808.

Re: [gentoo-user] Locked desktop session but still running computer

[Javier Martinez]

[-- Attachment #1.1.1: Type: text/plain, Size: 927 bytes --]

El 4/7/25 a las 19:58, whiteman808 escribió:
> Hello,
> 
> I have a possibly stupid question motivated by curiosity. Is it possible to gain access to root account, or maybe at least have an access to regular user console, or even unlock desktop session without knowing password of root or regular user's password? How this can be done? I'm talking about computer not having any remote services like ssh exposed, even in lan
> 
> What should I do if for example I forgot hypothetically luks encryption password but still have computer powered on and locked gnome or kde session?
> 
> What in case if PC doesn't have enabled magic sysrq?
> 
> Just asking because I'm curious, not because I have problem described
> above
> 
> Thank you,
> whiteman808.


ctrl+alt+backspace can give you terminal access if you locked your X 
windows and it had not been started from a display manager (so started 
with startx)

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 3145 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 840 bytes --]

[gentoo-user] Re: Locked desktop session but still running computer

[Nuno Silva]

On 2025-07-04, Javier Martinez wrote:

> El 4/7/25 a las 19:58, whiteman808 escribió:
>> Hello,
>>
>> I have a possibly stupid question motivated by curiosity. Is it
>> possible to gain access to root account, or maybe at least have an
>> access to regular user console, or even unlock desktop session
>> without knowing password of root or regular user's password? How
>> this can be done? I'm talking about computer not having any remote
>> services like ssh exposed, even in lan
>>
>> What should I do if for example I forgot hypothetically luks
>> encryption password but still have computer powered on and locked
>> gnome or kde session?
>>
>> What in case if PC doesn't have enabled magic sysrq?
>>
>> Just asking because I'm curious, not because I have problem described
>> above
>>
>> Thank you,
>> whiteman808.
>
>
> ctrl+alt+backspace can give you terminal access if you locked your X
> windows and it had not been started from a display manager (so started
> with startx)

Unless you've locked it with vlock, I suppose?

(vlock -na)

-- 
Nuno Silva

Re: [gentoo-user] Re: Locked desktop session but still running computer

[Javier Martinez]

[-- Attachment #1.1.1: Type: text/plain, Size: 1313 bytes --]

El 5/7/25 a las 1:46, Nuno Silva escribió:
> On 2025-07-04, Javier Martinez wrote:
> 
>> El 4/7/25 a las 19:58, whiteman808 escribió:
>>> Hello,
>>>
>>> I have a possibly stupid question motivated by curiosity. Is it
>>> possible to gain access to root account, or maybe at least have an
>>> access to regular user console, or even unlock desktop session
>>> without knowing password of root or regular user's password? How
>>> this can be done? I'm talking about computer not having any remote
>>> services like ssh exposed, even in lan
>>>
>>> What should I do if for example I forgot hypothetically luks
>>> encryption password but still have computer powered on and locked
>>> gnome or kde session?
>>>
>>> What in case if PC doesn't have enabled magic sysrq?
>>>
>>> Just asking because I'm curious, not because I have problem described
>>> above
>>>
>>> Thank you,
>>> whiteman808.
>>
>>
>> ctrl+alt+backspace can give you terminal access if you locked your X
>> windows and it had not been started from a display manager (so started
>> with startx)
> 
> Unless you've locked it with vlock, I suppose?
> 
> (vlock -na)
> 

IMHO vlock can't lock standard tty.

I want mean, vlock can lock all xterms you have opened for example, not 
the login session opened at tty2

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 3145 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 840 bytes --]

Re: [gentoo-user] Re: Locked desktop session but still running computer

[whiteman808]

On 05 Jul 2025, 05:18:28, Javier Martinez wrote:
> El 5/7/25 a las 1:46, Nuno Silva escribió:
> > On 2025-07-04, Javier Martinez wrote:
> > 
> > > El 4/7/25 a las 19:58, whiteman808 escribió:
> > > > Hello,
> > > > 
> > > > I have a possibly stupid question motivated by curiosity. Is it
> > > > possible to gain access to root account, or maybe at least have an
> > > > access to regular user console, or even unlock desktop session
> > > > without knowing password of root or regular user's password? How
> > > > this can be done? I'm talking about computer not having any remote
> > > > services like ssh exposed, even in lan
> > > > 
> > > > What should I do if for example I forgot hypothetically luks
> > > > encryption password but still have computer powered on and locked
> > > > gnome or kde session?
> > > > 
> > > > What in case if PC doesn't have enabled magic sysrq?
> > > > 
> > > > Just asking because I'm curious, not because I have problem described
> > > > above
> > > > 
> > > > Thank you,
> > > > whiteman808.
> > > 
> > > 
> > > ctrl+alt+backspace can give you terminal access if you locked your X
> > > windows and it had not been started from a display manager (so started
> > > with startx)
> > 
> > Unless you've locked it with vlock, I suppose?
> > 
> > (vlock -na)
> > 
> 
> IMHO vlock can't lock standard tty.
> 
> I want mean, vlock can lock all xterms you have opened for example, not the
> login session opened at tty2

I ask about if it's possible to gain in some smart way access to data
stored on powered on physical computer while PC is locked (tty or DE)
and I want know about methods of doing it.

[gentoo-user] Re: Locked desktop session but still running computer

[Anna Vyalkova]

On 2025-07-05, whiteman808 wrote:
> I ask about if it's possible to gain in some smart way access to data
> stored on powered on physical computer while PC is locked (tty or DE)
> and I want know about methods of doing it.

If someone with the right forensics tools for the task has physical 
access to your powered on PC, they will be able to capture your RAM and 
decrypt everything.

https://en.wikipedia.org/wiki/Computer_forensics#Volatile_data

If this scenario is in your threat model, consider configuring a "kill 
switch", e.g. https://github.com/hephaest0s/usbkill

Other means could be considered too:

https://en.wikipedia.org/wiki/Anti–computer_forensics#Physical

Re: [gentoo-user] Re: Locked desktop session but still running computer

[Javier Martinez]

[-- Attachment #1.1.1: Type: text/plain, Size: 1732 bytes --]

El 5/7/25 a las 7:13, whiteman808 escribió:
> On 05 Jul 2025, 05:18:28, Javier Martinez wrote:
>> El 5/7/25 a las 1:46, Nuno Silva escribió:
>>> On 2025-07-04, Javier Martinez wrote:
>>>
>>>> El 4/7/25 a las 19:58, whiteman808 escribió:
>>>>> Hello,
>>>>>
>>>>> I have a possibly stupid question motivated by curiosity. Is it
>>>>> possible to gain access to root account, or maybe at least have an
>>>>> access to regular user console, or even unlock desktop session
>>>>> without knowing password of root or regular user's password? How
>>>>> this can be done? I'm talking about computer not having any remote
>>>>> services like ssh exposed, even in lan
>>>>>
>>>>> What should I do if for example I forgot hypothetically luks
>>>>> encryption password but still have computer powered on and locked
>>>>> gnome or kde session?
>>>>>
>>>>> What in case if PC doesn't have enabled magic sysrq?
>>>>>
>>>>> Just asking because I'm curious, not because I have problem described
>>>>> above
>>>>>
>>>>> Thank you,
>>>>> whiteman808.
>>>>
>>>>
>>>> ctrl+alt+backspace can give you terminal access if you locked your X
>>>> windows and it had not been started from a display manager (so started
>>>> with startx)
>>>
>>> Unless you've locked it with vlock, I suppose?
>>>
>>> (vlock -na)
>>>
>>
>> IMHO vlock can't lock standard tty.
>>
>> I want mean, vlock can lock all xterms you have opened for example, not the
>> login session opened at tty2
> 
> I ask about if it's possible to gain in some smart way access to data
> stored on powered on physical computer while PC is locked (tty or DE)
> and I want know about methods of doing it.
> 

Dumping RAM memory through firewire port

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 3145 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 840 bytes --]

[gentoo-user] Re: Locked desktop session but still running computer

[Nuno Silva]

On 2025-07-05, Javier Martinez wrote:

> El 5/7/25 a las 1:46, Nuno Silva escribió:
>> On 2025-07-04, Javier Martinez wrote:
>>
>>> El 4/7/25 a las 19:58, whiteman808 escribió:
>>>> Hello,
>>>>
>>>> I have a possibly stupid question motivated by curiosity. Is it
>>>> possible to gain access to root account, or maybe at least have an
>>>> access to regular user console, or even unlock desktop session
>>>> without knowing password of root or regular user's password? How
>>>> this can be done? I'm talking about computer not having any remote
>>>> services like ssh exposed, even in lan
>>>>
>>>> What should I do if for example I forgot hypothetically luks
>>>> encryption password but still have computer powered on and locked
>>>> gnome or kde session?
>>>>
>>>> What in case if PC doesn't have enabled magic sysrq?
>>>>
>>>> Just asking because I'm curious, not because I have problem described
>>>> above
>>>>
>>>> Thank you,
>>>> whiteman808.
>>>
>>>
>>> ctrl+alt+backspace can give you terminal access if you locked your X
>>> windows and it had not been started from a display manager (so started
>>> with startx)
>>
>> Unless you've locked it with vlock, I suppose?
>>
>> (vlock -na)
>>
>
> IMHO vlock can't lock standard tty.
>
> I want mean, vlock can lock all xterms you have opened for example,
> not the login session opened at tty2

I think the Linux virtual consoles might be precisely what vlock is
intended to lock, or at least its online manual features the expression
"virtual console" and suggests that focus/purpose.

It will also work on standard terminals (say, something from DEC on
ttyS0) and on terminal emulators like xterm.

With the X session itself, it works by instead creating an additional
virtual console to switch to.

-- 
Nuno Silva