Encrypt your GRUB passwords for better security

The previous post was a tutorial on how to enable or password protect the GRUB. But I think it is not complete. The passwords will be  stored as plain
text if you perform the changes given in the previous post. In order to encrypt those passwords you must generate an encrypted version for each. For
this we use grub-mkpasswd-pbkdf2


1. Open the terminal
2. Run the following command
3. Enter the desired password and reenter it when prompted.
Read More »

Protect your GRUB from unauthorized editing with passwords


Here I consider GRUB 2 and in the following post GRUB means GRUB 2.

If you are a GNU/Linux user, GRUB will be quite familiar to you. It is the first thing you see after you switch on the system. As the expansion of GRUB (GRand Unified Bootloader) suggests it is a boot loader. This is very helpful in various situations. Earlier I had written a post regarding GRUB with its ability to modify the way it appears to the user. The other side is about the security which is of greater importance. After the installation of GRUB it is open to all i.e, anybody can edit the GRUB entries and gain the superuser privilege. So protecting the grub with passwords restricts this attack.

First of all let me introduce to you some of the grub scripts included under /etc/grub.d/


These are used to generate the grub.cfg file under /boot/grub/ on running update-grub. Among these we will consider only 00_header, 10_linux,
20_memtest86+ and 30_os-prober. A superuser must be designated. This user can select all menu entries, edit any items in the GRUB menu during the
boot process, and access the GRUB terminal.The superuser is identified as
set superusers=”<user>”
Ex:- set superusers=”root”
The format for adding the superuser password and any additional users and passwords
password <user> <password>
Ex:- password root 123456
If you wish more users to be added append those with the above line
Ex:- password root 123456
      password tom tom123
      password alen alen

Note: Encryption of passwords will be explained later.

Open /etc/grub.d/00_header and add the following at the bottom of the file.
cat << EOF
        set superusers=”root”
        password root 123456
Each type of OS entries are protected through different scripts.

For linux entries, find the following line in /etc/grub.d/10_linux
printf “menuentry ‘${title}’ ${CLASS} {\n” “${os}” “${version}”
Add –users to allow permission to superuser
printf “menuentry ‘${title}’ ${CLASS} –users {\n” “${os}” “${version}”
Add –users tom to allow permission to superuser+tom
        printf “menuentry ‘${title}’ ${CLASS} –users tom {\n” “${os}” “${version}”
Add –users tom,alen to allow permission to superuser+tom+alen
printf “menuentry ‘${title}’ ${CLASS} –users tom,alen {\n” “${os}” “${version}”

For other OS entries, find lines starting with menu entry in /etc/grub.d/30_os-prober and add –users after –class os to requires entries.
For memory test entry, modification is to be done inside /etc/grub.d/20_memtest86+ in the following lines
 menuentry “Memory test (memtest86+)” {
    menuentry “Memory test (memtest86+, serial console 115200)” {

Run sudo update-grub after all modifications.