How Do I Secure Grub Boot Loader?

by Vivek Gite on October 19, 2005 · 5 comments

You can set a password for the GRUB bootloader. This prevents users from entering single user mode or changing settings at boot time.

When your system is rebooted, grub presents the boot option menu. From this menu one can easily login into a single user mode without the password which might result into compromise system security.

For example, anyone can access the data or change the settings. However you can setup a password for grub with password option. This option forces grub to ask for a password before making any changes or entering into single user mode. You need to type p followed by password.

#1: Create A Password For Grub

Type grub-md5-crypt command to create password in MD5 format:
# grub-md5-cryptOutput:

Password:<ENTER-YOUR-PASSWORD>
Retype password:<ENTER-YOUR-PASSWORD>
$1$NYoR71$Sgv6pxQ6LG4GXpfihIJyL0

Please note that you need to copy and paste the MD5 password ($1$NYoR71$Sgv6pxQ6LG4GXpfihIJyL0) to your configuration file. Use mouse to copy the same.

#2 Add MD5 Password To Grub Configuration File

Under Debian GNU/Linux the Grub configuration file is located at /boot/grub/menu.lst. (Red Hat / Fedora user use /boot/grub/grub.conf file)
# vi /boot/grub/menu.lst
Edit file and add a password line as follows:
password --md5 $1$NYoR71$Sgv6pxQ6LG4GXpfihIJyL0
Here is my sample config file:

default         0
timeout         5
password --md5 $1$NYoR71$Sgv6pxQ6LG4GXpfihIJyL0
title           Debian GNU/Linux, kernel 2.6.13.4-cust-en-smp
root           (hd0,0)
kernel        /boot/vmlinuz root=/dev/hda3 ro
savedefault
boot

Save and close the file.

Optional Settings for Dual Booting Computer

If you dual boot with Windows XP/2000/7, consider adding lock command to Windows XP right after title command:

title           Windows NT/2000/XP
lock
root            (hd0,1)
savedefault
makeactive
chainloader     +1

Note the lock option can be also added to the failsafe entry too. For more information please read

grub and grub-md5-crypt man pages
Read Grub seurity manual page online.

Featured Articles:

Share this with other sys admins!
Facebook it - Tweet it - Print it -

We're here to help you make the most of sysadmin work. So, subscribe!

{ 5 comments… read them below or add one }

1 viswanath June 17, 2007

In my computer-windows 98 and windows xp is then i installed linux —–while upgrading/reinstalling the windows xp , after installing xp linux access is gone —i mean system MBR is overwritten and i am unable to access linux. will plz tell me the solution and when i am booting system it directly going to linux, i want to change this menu –the system has to go to windows xp , if select linux then only it has to into linux

plz any body give solution for my problem

thank u

2 amresh June 10, 2010: you can restore primary in rescue mode
step of recover grub:
insert linux cd
boot from cd
whwn you get the prompt you will have to write
boot: linux rescue
chroot /mnt/sysimage
grub-install /dev/sda (depend your hard drive type)
your grub will be repair
Reply

3 Kamahl November 12, 2007

Try reinstalling grub. There should be a command on your install disk/liveCD to do reinstall grub. This will locate *all* your partitions. The microsoft one is bias, and refuses to notice anything nonwindows.

4 ujj February 24, 2008

use ur linux cd & get into rescue mode
then try out these commands :
1. grub-install /dev/hda (or /dev/sda whatever it may be)
2. root (hd0,0) (in the bracket the last zero specifies ur /boot partition number )
3. setup (hd0)

with these steps u are done .

5 KDK November 5, 2009

Alternatively you could do it a safer way.
get dd for windows and copy the bootsector of the linux partition (the first 512 bytes) into a file and call it something memorable like bootsect.dat.
Put that in the root of your c: drive and open up boot.ini and add a line such as this.
C:\BOOTSECT.DAT=”RedHat Linux”
C:\BOOTSECT.DAT=”Mandrake Linux”

Bingo you have your windows loader loading windows and linux, and you didn’t endanger the current running system

I am aware this thread is over 2 years old btw