Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I do as the following

  1. run grub-mkpasswd-pbkdf2 to get a string
  2. nano /boot/grub/grub.cfg
  3. add tow lines
  4. set superusers="putyourusernamehere"
  5. password putyourusernamehere grub.pbkdf2 (omitted)

When i reopen my computer,it can't work,how can i take grub 2 Password Protection in debian ?

share|improve this question

migrated from stackoverflow.com Oct 16 '12 at 4:41

This question came from our site for professional and enthusiast programmers.

2 Answers 2

Debian 8 (jessie) stores Grub 2 password parameters within the directory /etc/grub.d/ . Inside this directory there are only scripts used to generate the configuration file.

So you can create a new script (e.g. /etc/grub.d/01_users ) with the following content:

#!/bin/bash

cat <<EOF
set superusers="putyourusernamehere"
password putyourusernamehere grub.pbkdf2 grub.pbkdf2.sha512.10000.3450C89...
EOF

All the above lines are part of the file, because it is a script whose output will go in the final configuration file. Since it is a script, it will only be processed if it is executable (chmod a+x ...).

As an alternative, you may put just the lines you need in one of the existing files that are tweaked to output their own contents. Here you can see how /etc/grub.d/40_custom substitutes the shell which launches it, with a tail command returning the content of itself except the first three lines:

grub.pbkdf2.sha512.10000.3450C89... 
#!/bin/sh
exec tail -n +3 $0

set superusers="putyourusernamehere"
password putyourusernamehere grub.pbkdf2 

A piece of advice: you may want to add "--unrestricted" to menu entries, or you will be prompted for the password also when booting without modifying the entry. So, within 10_linux :

10_linux:CLASS="--class gnu-linux --class gnu --class os --unrestricted"

The following command will "patch" the script that generates the entries for non-Linux operating systems, so no password is required when booting them:

sed -i "s/menuentry \(.*\) --class/menuentry \1 --restricted --class/" 30_os-prober 

Remember to prevent the password from being read by users. You can accomplish it either by generating it with grub-mkpasswd-pbkdf2, or by making the script not readable by others if the password is in clear text (weaker).

Finally launch update-grub2 to generate the final configuration file /boot/grub/grub.cfg .

share|improve this answer
    
Do you mean cat << EOF? –  G-Man Jun 14 at 9:00
    
@G-Man indeed txs –  Enos Jun 14 at 18:38

Read this. Official documentation from the debian-based OS: Ubuntu. Maybe it can help

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.