Tuesday, January 15, 2008

Secure GRUB

No its not about food. Its about making sure no one fiddles with your boot menu which can allow them to boot into single user more or change any other setting. Here's how you do it :-

  • To create a password, type "grub-md5-crypt". Enter your desired password TWICE and if it matches, the application will give you the MD5 password. Example
    • grub-md5-crypt
    • Password : <Enter your password>
    • Retype password : <Enter your password again>
    • $1$D3V8K$EnFFr14dK5PCgmz2GCsDS.
  • Copy the output given i.e. "$1$D3V8K$EnFFr14dK5PCgmz2GCsDS." either by using your mouse or you can write it down somewhere.
  • Edit your GRUB config file in "/boot/grub/menu.1st".
  • Add the line "password --md5 <MD5 password>". It can look like this
    • default 0
    • timeout 3
    • password --md5 $1$D3V8K$EnFFr14dK5PCgmz2GCsDS.
    • hiddenmenu
  • Optionally, if you dual boot, you can also make sure Windows does not boot unless the password you specified is given. For it just add the word 'lock' after the 'title' section for Windows
    • title 'Windows XP Professional Edition'
    • lock
    • root (hd0, 1)
    • chainloader +1
  • Quit and save your changes
And you're done. Happy grub-ing...

No comments: