Debian 8 (jessie) stores Grub 2 password parameters within the directory /etc/grub.d/
. Inside this directory there are only scripts used to generate the configuration file.
So you can create a new script (e.g. /etc/grub.d/01_users
) with the following content:
#!/bin/bash
cat <<EOF
set superusers="putyourusernamehere"
password putyourusernamehere grub.pbkdf2 grub.pbkdf2.sha512.10000.3450C89...
EOF
All the above lines are part of the file, because it is a script whose output will go in the final configuration file. Since it is a script, it will only be processed if it is executable (chmod a+x ...
).
As an alternative, you may put just the lines you need in one of the existing files that are tweaked to output their own contents. Here you can see how /etc/grub.d/40_custom
substitutes the shell with a tail command returning script contents starting from the third line:
#!/bin/sh
exec tail -n +3 $0
set superusers="putyourusernamehere"
password putyourusernamehere grub.pbkdf2 grub.pbkdf2.sha512.10000.3450C89...
In some Ubuntu derivatives (e.g. Mint 19) the format of the password changed as follows:
#!/bin/sh
exec tail -n +3 $0
set superusers=putyourusernamehere
password_pbkdf2 putyourusernamehere grub.pbkdf2.sha512.10000.3450C89...
You may want to add "--unrestricted" to the menu entries you want to boot without a password. For example within the file 10_linux
:
10_linux:CLASS="--class gnu-linux --class gnu --class os --unrestricted"
Finally launch update-grub2
to generate the final configuration file /boot/grub/grub.cfg
.