GRUB: How to enable a password to boot operating systems

[ChrisUlrich]

GRUB has already discussed on several occasions, but perhaps not everyone knows that This excellent boot manager, which start automatically with some of the most popular Linux distro (eg. Ubuntu), is equipped with advanced features for safety that allows all of us to sleep more relaxed, much more relaxed about the degree of confidentiality and privacy of data of the OS.

So if you have not yet understood, we will see how to enable a password to boot the operating systems through GRUB. Need to do some 'of "hacking' in the terminal, but nothing quite tremendous. Here's how:

1. Open the terminal
   
   
2. Type sudo grub and press the Enter key
   
   
3. Key md5crypt, press the Enter key, type your password and pin somewhere the output of command (because it is the password you have to use)
   
   
   
   
4. Create a backup copy of the file /boot/grub/menu.lst
   
   
5. Back in Terminal, type sudo gedit /boot/grub/menu.lst and press the Enter key
   
   
   
   
6. Go to the line preceding the written BEGIN AUTOMAGIC KERNEL LIST and paste password-md5 [the result of the previously noted] (as you can see from the screenshot that opens this post)
   
   
7. Go to the row that happens the writing on each bootable system (ie: "title Windows Vista / Longhorn loader") and paste lock (as you can see from the screenshot a few lines above)
   
   
   
   
8. Save the file and restart the computer.

That's all, folks! From now on, to access your operating system and to edit the GRUB menu anyone will need to enter a strong password. And then they say that maintaining a secure operating system is a difficult task

[FlashX]

I do not know the command md5crypt, but I assume that in order to obtain the hash of the password you must enter after the command, the desired password ... right?

[XDRoX]

Hmm, what if someone manages to bypass or replace the Grub bootloader? then the password lock would not matter.

[ChrisUlrich]

To lock the recovery mode entries it is best to change the line to lockalternative = false lockalternative = true. This will lock down all future entries recovery mode as well even if you update the kernel.