Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I do as the following

  1. run grub-mkpasswd-pbkdf2 to get a string
  2. nano /boot/grub/grub.cfg
  3. add two lines
  4. set superusers="putyourusernamehere"
  5. password putyourusernamehere grub.pbkdf2 (omitted)

When I reopen my computer,it can't work,how can I take grub 2 Password Protection in debian ?

share|improve this question

migrated from stackoverflow.com Oct 16 '12 at 4:41

This question came from our site for professional and enthusiast programmers.

Debian 8 (jessie) stores Grub 2 password parameters within the directory /etc/grub.d/ . Inside this directory there are only scripts used to generate the configuration file.

So you can create a new script (e.g. /etc/grub.d/01_users ) with the following content:

#!/bin/bash

cat <<EOF
set superusers="putyourusernamehere"
password putyourusernamehere grub.pbkdf2 grub.pbkdf2.sha512.10000.3450C89...
EOF

All the above lines are part of the file, because it is a script whose output will go in the final configuration file. Since it is a script, it will only be processed if it is executable (chmod a+x ...).

As an alternative, you may put just the lines you need in one of the existing files that are tweaked to output their own contents. Here you can see how /etc/grub.d/40_custom substitutes the shell which launches it, with a tail command returning the content of itself except the first three lines:

grub.pbkdf2.sha512.10000.3450C89... 
#!/bin/sh
exec tail -n +3 $0

set superusers="putyourusernamehere"
password putyourusernamehere grub.pbkdf2 

A piece of advice: you may want to add "--unrestricted" to menu entries, or you will be prompted for the password also when booting without modifying the entry. So, within 10_linux :

10_linux:CLASS="--class gnu-linux --class gnu --class os --unrestricted"

The following command will "patch" the script that generates the entries for non-Linux operating systems, so no password is required when booting them:

sed -i "s/menuentry \(.*\) --class/menuentry \1 --restricted --class/" 30_os-prober 

Remember to prevent the password from being read by users. You can accomplish it either by generating it with grub-mkpasswd-pbkdf2, or by making the script not readable by others if the password is in clear text (weaker).

Finally launch update-grub2 to generate the final configuration file /boot/grub/grub.cfg .

share|improve this answer
    
Do you mean cat << EOF? – G-Man Jun 14 '15 at 9:00
    
@G-Man indeed txs – Enos Jun 14 '15 at 18:38

Read this. Official documentation from the debian-based OS: Ubuntu. Maybe it can help

share|improve this answer

You must log in to answer this question.