How Do I Secure Grub Boot Loader?

by Vivek Gite · 4 comments

You can set a password for the GRUB bootloader. This prevents users from entering single user mode or changing settings at boot time.

When your system is rebooted, grub presents the boot option menu. From this menu one can easily login into a single user mode without the password which might result into compromise system security.

For example, anyone can access the data or change the settings. However you can setup a password for grub with password option. This option forces grub to ask for a password before making any changes or entering into single user mode. You need to type p followed by password.

#1: Create A Password For Grub

Type grub-md5-crypt command to create password in MD5 format:
# grub-md5-cryptOutput:

Password:<ENTER-YOUR-PASSWORD>
Retype password:<ENTER-YOUR-PASSWORD>
$1$NYoR71$Sgv6pxQ6LG4GXpfihIJyL0

Please note that you need to copy and paste the MD5 password ($1$NYoR71$Sgv6pxQ6LG4GXpfihIJyL0) to your configuration file. Use mouse to copy the same.

#2 Add MD5 Password To Grub Configuration File

Under Debian GNU/Linux the Grub configuration file is located at /boot/grub/menu.lst. (Red Hat / Fedora user use /boot/grub/grub.conf file)
# vi /boot/grub/menu.lst
Edit file and add a password line as follows:
password --md5 $1$NYoR71$Sgv6pxQ6LG4GXpfihIJyL0
Here is my sample config file:

default         0
timeout         5
password --md5 $1$NYoR71$Sgv6pxQ6LG4GXpfihIJyL0
title           Debian GNU/Linux, kernel 2.6.13.4-cust-en-smp
root           (hd0,0)
kernel        /boot/vmlinuz root=/dev/hda3 ro
savedefault
boot

Save and close the file.

Optional Settings for Dual Booting Computer

If you dual boot with Windows XP/2000/7, consider adding lock command to Windows XP right after title command:

title           Windows NT/2000/XP
lock
root            (hd0,1)
savedefault
makeactive
chainloader     +1

Note the lock option can be also added to the failsafe entry too. For more information please read

Featured Articles:

Want to read Linux tips and tricks, but don't have time to check our blog everyday? Subscribe to our daily email newsletter to make sure you don't miss a single tip/tricks. Subscribe to our weekly newsletter here!

{ 4 comments… read them below or add one }

1 viswanath 06.17.07 at 12:08 pm

In my computer-windows 98 and windows xp is then i installed linux —–while upgrading/reinstalling the windows xp , after installing xp linux access is gone —i mean system MBR is overwritten and i am unable to access linux. will plz tell me the solution and when i am booting system it directly going to linux, i want to change this menu –the system has to go to windows xp , if select linux then only it has to into linux

plz any body give solution for my problem

thank u

2 Kamahl 11.12.07 at 12:32 pm

Try reinstalling grub. There should be a command on your install disk/liveCD to do reinstall grub. This will locate *all* your partitions. The microsoft one is bias, and refuses to notice anything nonwindows.

3 ujj 02.24.08 at 1:21 pm

use ur linux cd & get into rescue mode
then try out these commands :
1. grub-install /dev/hda (or /dev/sda whatever it may be)
2. root (hd0,0) (in the bracket the last zero specifies ur /boot partition number )
3. setup (hd0)

with these steps u are done .

4 KDK 11.05.09 at 5:15 pm

Alternatively you could do it a safer way.
get dd for windows and copy the bootsector of the linux partition (the first 512 bytes) into a file and call it something memorable like bootsect.dat.
Put that in the root of your c: drive and open up boot.ini and add a line such as this.
C:\BOOTSECT.DAT=”RedHat Linux”
C:\BOOTSECT.DAT=”Mandrake Linux”

Bingo you have your windows loader loading windows and linux, and you didn’t endanger the current running system

I am aware this thread is over 2 years old btw

Leave a Comment

You can use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>

Previous post:

Next post: