5. Protect Grub Boot Loader by Password.md

🔐 Protect GRUB Boot Loader with a Password in Linux

By default, GRUB allows users to edit boot parameters during startup. This can be a security risk since anyone with access to the system can modify boot settings (e.g., boot into single-user mode and change the root password).

To prevent unauthorized access, we can secure GRUB with a password.

✅ Works for: Ubuntu, Debian, CentOS, RHEL, Fedora, Rocky Linux, AlmaLinux

---

📌 1. Generate a GRUB Password Hash

Instead of storing a plain-text password, we use an encrypted password.

✅ Generate an Encrypted GRUB Password

Run the following command:

grub-mkpasswd-pbkdf2

📌 Example Output:

Enter password: ********
Reenter password: ********
PBKDF2 hash of your password is grub.pbkdf2.sha512.10000.XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

🔹 Copy the generated hash (everything after PBKDF2 hash of your password is).

---

📌 2. Edit the GRUB Configuration File

Now, we need to store the password in the GRUB configuration.

✅ Open the GRUB Configuration File

sudo nano /etc/grub.d/40_custom

✅ Add the Following Lines

set superusers="admin"
password_pbkdf2 admin grub.pbkdf2.sha512.10000.XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

🔹 Replace admin with your desired username.
🔹 Replace grub.pbkdf2.sha512... with the hash generated earlier.

✅ Save and exit: CTRL + X → Y → ENTER

---

📌 3. Restrict Access to GRUB Menu Entries

Now, prevent normal users from modifying boot settings.

✅ Modify /etc/grub.d/10_linux to Require a Password

sudo nano /etc/grub.d/10_linux

Find the echo "menuentry ..." section and modify it like this:

echo "menuentry 'Ubuntu' --users admin {"

📌 This ensures only admin can edit GRUB entries.

✅ Save and exit: CTRL + X → Y → ENTER

---

📌 4. Apply the Changes

After making modifications, update the GRUB configuration:

sudo grub-mkconfig -o /boot/grub/grub.cfg

📌 On UEFI Systems:

sudo grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg  # RHEL/CentOS

✅ Now, GRUB is protected!

---

📌 5. Test GRUB Password Protection

1️⃣ Reboot the system:

sudo reboot

2️⃣ Press e to edit a boot entry → You should now be prompted for a username and password.
3️⃣ Enter the admin username and password.

✅ Success! Unauthorized users can no longer modify boot parameters.

---

📌 6. Secure Single-User Mode (Extra Security)

Even with a GRUB password, users can boot into single-user mode and change the root password.
To prevent this:

✅ Edit /etc/sysconfig/init (CentOS/RHEL)

sudo nano /etc/sysconfig/init

Change:

SINGLE=/sbin/sulogin

✅ Edit /etc/inittab (Older Systems)

sudo nano /etc/inittab

Add:

~:S:wait:/sbin/sulogin

✅ Now, single-user mode requires the root password!

---

📌 7. Recover Lost GRUB Password (If Forgotten)

If you forget the GRUB password, follow these steps:

1️⃣ Boot from a Live USB
2️⃣ Mount the root partition

sudo mount /dev/sda2 /mnt
sudo chroot /mnt

3️⃣ Remove the GRUB Password

nano /etc/grub.d/40_custom

🚀 Delete the password_pbkdf2 line, save, and exit.
4️⃣ Regenerate GRUB Configuration

sudo grub-mkconfig -o /boot/grub/grub.cfg

5️⃣ Reboot the System

✅ Now GRUB password protection is removed!

---

📊 Summary of GRUB Protection

Step	Command	Purpose
Generate Password Hash	grub-mkpasswd-pbkdf2	Creates a secure GRUB password
Edit GRUB Config	sudo nano /etc/grub.d/40_custom	Adds password to GRUB
Restrict Menu Access	sudo nano /etc/grub.d/10_linux	Requires authentication for boot options
Update GRUB	sudo grub-mkconfig -o /boot/grub/grub.cfg	Applies the password protection
Secure Single-User Mode	sudo nano /etc/sysconfig/init	Prevents unauthorized root password resets
Recover Forgotten Password	Boot Live USB → Edit /etc/grub.d/40_custom	Remove password if lost

---