Here I consider GRUB 2 and in the following post GRUB means GRUB 2.

If you are a GNU/Linux user, GRUB will be quite familiar to you. It is the first thing you see after you switch on the system. As the expansion of GRUB (GRand Unified Bootloader) suggests it is a boot loader. This is very helpful in various situations. Earlier I had written a post regarding GRUB with its ability to modify the way it appears to the user. The other side is about the security which is of greater importance. After the installation of GRUB it is open to all i.e, anybody can edit the GRUB entries and gain the superuser privilege. So protecting the grub with passwords restricts this attack.

First of all let me introduce to you some of the grub scripts included under /etc/grub.d/

00_header
05_debian_theme
10_linux
20_linux_xen
20_memtest86+  
30_os-prober
30_uefi-firmware
40_custom  
41_custom  
README

These are used to generate the grub.cfg file under /boot/grub/ on running update-grub. Among these we will consider only 00_header, 10_linux,
20_memtest86+ and 30_os-prober. A superuser must be designated. This user can select all menu entries, edit any items in the GRUB menu during the
boot process, and access the GRUB terminal.The superuser is identified as
set superusers=”<user>”
Ex:- set superusers=”root”
The format for adding the superuser password and any additional users and passwords
password <user> <password>
Ex:- password root 123456
If you wish more users to be added append those with the above line
Ex:- password root 123456
      password tom tom123
      password alen alen

Note: Encryption of passwords will be explained later.

Open /etc/grub.d/00_header and add the following at the bottom of the file.
cat << EOF
        set superusers=”root”
        password root 123456
        EOF
Each type of OS entries are protected through different scripts.

For linux entries, find the following line in /etc/grub.d/10_linux
printf “menuentry ‘${title}’ ${CLASS} {\n” “${os}” “${version}”
Add –users to allow permission to superuser
printf “menuentry ‘${title}’ ${CLASS} –users {\n” “${os}” “${version}”
Add –users tom to allow permission to superuser+tom
        printf “menuentry ‘${title}’ ${CLASS} –users tom {\n” “${os}” “${version}”
Add –users tom,alen to allow permission to superuser+tom+alen
printf “menuentry ‘${title}’ ${CLASS} –users tom,alen {\n” “${os}” “${version}”

For other OS entries, find lines starting with menu entry in /etc/grub.d/30_os-prober and add –users after –class os to requires entries.
For memory test entry, modification is to be done inside /etc/grub.d/20_memtest86+ in the following lines
 menuentry “Memory test (memtest86+)” {
    menuentry “Memory test (memtest86+, serial console 115200)” {

Run sudo update-grub after all modifications.