bootloader_configuration.md

Post install tasks

Bootloader configuration (grub)

ℹ️ Introduction

Protection for the boot loader can prevent unauthorized users who have physical access to systems, e.g. attaining root privileges through single user mode.

Basically when you want to prohibit unauthorized reconfiguring of your system, otherwise anybody could load anything on it.

✴️ Protect bootloader with password

You can set password for the bootloader for prevents users from entering single user mode, changing settings at boot time, access to the bootloader console, reset the root password, if there is no password for GRUB-menu or access to non-secure operating systems.

Generate password hash

# Debian like distributions
grub-mkpasswd-pbkdf2

# RedHat like distributions
grub2-mkpasswd-pbkdf2

Updated grub configuration

cat > /etc/grub.d/01_hash << __EOF__
set superusers="user"
password_pbkdf2 user
grub.pbkdf2.sha512.<hash> # rest of your password hash
__EOF__

And regenerate grub configuration:

# Debian like distributions
grub-mkconfig > /boot/grub/grub.cfg

# RedHat like distributions
grub2-mkconfig > /boot/grub2/grub.cfg

Useful resources

• How To Password Protect GRUB Bootloader In Linux

✴️ Protect bootloader config files

Set the owner and group of /etc/grub.conf to the root user:

chown root:root /etc/grub.conf

or

chown -R root:root /etc/grub.d

Set permission on the /etc/grub.conf or /etc/grub.d file to read and write for root only:

chmod og-rwx /etc/grub.conf

or

chmod -R og-rwx /etc/grub.d

☑️ Summary checklist

Item	True	False
Set password for the bootloader	🔲	🔲