Debian 8 (jessie) stores Grub 2 password parameters within the directory
/etc/grub.d/ . Inside this directory there are only scripts used to generate the configuration file.
So you can create a new script (e.g.
/etc/grub.d/01_users ) with the following content:
password putyourusernamehere grub.pbkdf2 grub.pbkdf2.sha512.10000.3450C89...
All the above lines are part of the file, because it is a script whose output will go in the final configuration file. Since it is a script, it will only be processed if it is executable (
chmod a+x ...).
As an alternative, you may put just the lines you need in one of the existing files that are tweaked to output their own contents. Here you can see how
/etc/grub.d/40_custom substitutes the shell which launches it, with a tail command returning the content of itself except the first three lines:
exec tail -n +3 $0
password putyourusernamehere grub.pbkdf2
A piece of advice: you may want to add "--unrestricted" to menu entries, or you will be prompted for the password also when booting without modifying the entry. So, within
10_linux:CLASS="--class gnu-linux --class gnu --class os --unrestricted"
The following command will "patch" the script that generates the entries for non-Linux operating systems, so no password is required when booting them:
sed -i "s/menuentry \(.*\) --class/menuentry \1 --restricted --class/" 30_os-prober
Remember to prevent the password from being read by users. You can accomplish it either by generating it with
grub-mkpasswd-pbkdf2, or by making the script not readable by others if the password is in clear text (weaker).
update-grub2 to generate the final configuration file