Last Update: Sep 28, 2015

-----[ GRUB2 Password Tips ]-----

This document is intended to be a quick note about securing GRUB boot loader configuration with a passphrase. First of all you have to generate a strong key. This can be done through: # grub-mkpasswd-pbkdf2 The utility uses pbkdf2-hmac-sha512 to protect your passphrase against brute-force attacks. You can adjust the iteration count in order to improve the strength of the key derivation process with the -c option. The default value is 10000. # grub-mkpasswd-pbkdf2 -c1000000 Then you have to set a superuser in your GRUB configuration file. To preserve changes form future updates edit the /etc/grub.d/40_custom file. Add these lines: ----[ /etc/grub.d/40_custom ]----- | | set superusers="py" | password_pbkdf2 py grub.pbkdf2.sha512.1000000.11BD0653432FE3A7E2E3B00E... | -------------------------------------------------- If you want the password to prevent access to the GRUB command console only, you can use the --unrestricted option. Modify the script in /etc/grub.d/10_linux adding after: ----[ /etc/grub.d/10_linux ]----- | | CLASS="--class gnu-linux --class gnu --class os" | | if [ "x${GRUB_DISTRIBUTOR}" = "x" ] ; then | OS=Linux | else | OS="${GRUB_DISTRIBUTOR} Linux" | CLASS="--class $(echo ${GRUB_DISTRIBUTOR} | tr 'A-Z' 'a-z' | cut -d' ' | -f1|LC_ALL=C sed 's,[^[:alnum:]_],_,g') ${CLASS}" | fi | -------------------------------------------------- The line: ----[ /etc/grub.d/10_linux ]----- | | CLASS="--unrestricted ${CLASS}" | -------------------------------------------------- Now just run: # grub-mkconfig -o /boot/grub/grub.cfg This will set the unrestricted option to all the GRUB menu entry. Alternatively you can make a "sporca" - a dirty trick ;) - by editing the generated /boot/grub/grub.cfg after having run grub-mkconfig. Add the option --unrestricted to every menuentry you want, like this: ----[ /boot/grub/grub.cfg ]----- | | menuentry 'Arch Linux' --unrestricted --class arch --class gnu-linux | --class gnu --class os $menuentry_id_option | 'gnulinux-simple-2e0270af-9ced-4c4f-b728-bf7199f2c5a1' { | -------------------------------------------------- Note that /boot/grub/grub.cfg will be overwritten if you run grub-mkconfig again. ---------- [1] ArchLinux wiki