Encrypting Grub Menu

GRUB is a boot loader designed to boot a wide range of operating systems from a wide range of filesystems. GRUB is becoming popular due to the increasing number of possible root filesystems on which Linux can reside upon.

If anyone who has access to your grub menu can easily get into your machine,So for that encryption of grub menu is used.

Location of grub file:
/boot/grub/grub.conf
/etc/grub.conf

You can edit any of these if you have a root access to your machine.

Encrypting your Grub Menu:

Edit any of the above mentioned files.
[root@sunny ~]# vi /etc/grub.conf 

Your file should show something like this:

# grub.conf generated by anaconda
#
# Note that you do not have to rerun grub after making changes to this file
# NOTICE:  You have a /boot partition.  This means that
#          all kernel and initrd paths are relative to /boot/, eg.
#          root (hd0,0)
#          kernel /vmlinuz-version ro root=/dev/sda2
#          initrd /initrd-[generic-]version.img
#boot=/dev/sda
default=0
timeout=5
splashimage=(hd0,0)/grub/splash.xpm.gz
hiddenmenu
password redhat
title Red Hat Enterprise Linux (2.6.32-71.el6.x86_64)
        root (hd0,0)
        kernel /vmlinuz-2.6.32-71.el6.x86_64 ro root=UUID=6661bc1e-4463-4674-978c-b4a83d266bff rd_NO_LUKS rd_NO_LVM rd_NO_MD rd_NO_DM LANG=en_US.UTF-8 SYSFONT=latarcyrheb-sun16 KEYBOARDTYPE=pc KEYTABLE=us crashkernel=auto rhgb quiet
        initrd /initramfs-2.6.32-71.el6.x86_64.img

Just add a entry as "password YOURPASSWORD" without the quotes as shown above, In my case the password is redhat.

Now suppose that you want to make your password more encrypted, so for achieving this what you need to do is ?

Just fire a command called grub-md5-cryp, this command will encrypt your password in md5 format. For more information you can visit its man page.

[root@sunny ~]# grub-md5-crypt
Password:
Retype password:
$1$8l/Oe0$5dtdli/PeYqOP.UPBSfpb1
[root@sunny ~]#

Now you just need to make entry of this password which you created using grub-md5-crypt in your grub file as shown below.

[root@sunny ~]# vi /etc/grub.conf 

Your file should show something like this:

# grub.conf generated by anaconda
#
# Note that you do not have to rerun grub after making changes to this file
# NOTICE:  You have a /boot partition.  This means that
#          all kernel and initrd paths are relative to /boot/, eg.
#          root (hd0,0)
#          kernel /vmlinuz-version ro root=/dev/sda2
#          initrd /initrd-[generic-]version.img
#boot=/dev/sda
default=0
timeout=5
splashimage=(hd0,0)/grub/splash.xpm.gz
hiddenmenu
password --md5 $1$8l/Oe0$5dtdli/PeYqOP.UPBSfpb1
title Red Hat Enterprise Linux (2.6.32-71.el6.x86_64)
        root (hd0,0)
        kernel /vmlinuz-2.6.32-71.el6.x86_64 ro root=UUID=6661bc1e-4463-4674-978c-b4a83d266bff rd_NO_LUKS rd_NO_LVM rd_NO_MD rd_NO_DM LANG=en_US.UTF-8 SYSFONT=latarcyrheb-sun16 KEYBOARDTYPE=pc KEYTABLE=us crashkernel=auto rhgb quiet
        initrd /initramfs-2.6.32-71.el6.x86_64.img

Summary: Now when you will try to modify your grub menu via 'p' it will always prompt for a password which you just set via using above steps.

If you want to remove that password simply remove that entry.

Comments

Post a Comment

Popular posts from this blog

Installing Tomcat8 on RHEL6

Image
Apache-HTTP v/s Apache-Tomcat: The basic difference is Apache-Tomcat is written in Java but Apache-HTTP is written in C. Apart from this Apache-Tomcat is used as a webserver as well as to deploy Java Servlet's and JSP's [Java server pages] so basically Apache-Tomcat is used to serve Java Technologies whereas Apache-HTTP is used to serve HTTP. Prerequisites: Appropriate version of JRE [Java run-time environment] for instance jre1.7 is required to run tomcat-8[.X.X]. Tomcat binaries, for version 8 check this link . Sudo/Root access to the machine. Step1: Install JRE Download JRE from Java's official website. You can keep Java at any location but for my ease I have kept both Tomcat and Java in /opt. # cd /opt # cp jre-7u45-linux-x64.tar.gz . # tar -zxvf jre-7u45-linux-x64.tar.gz  The above command will create a folder with JRE binaries. In my case it was "jre1.7.0_45". Now set JRE_HOME [Required by Tomcat] and PATH. export JRE_HOME=/opt/jre1.7.
Read more

Manage existing resources via Helm

Manage existing resources via Helm Helm is really a very powerful tool for managing Kubernetes objects. With a single command, we can install or upgrade multiple related Kubernetes entities. Let's say we want to install any chart from the helm registry, we just need to type in the below command and helm will do the heavy lifting for us. $ helm install [RELEASE_NAME] [REPO]/[CHART] But below post is not about the basics of helm or how to install or upgrade a chart, etc. It's been a long time since I wrote anything, so I just thought to write something about what new I learned today :)  While installing one of my charts, I encountered below issue: Error: INSTALLATION FAILED: rendered manifests contain a resource that already exists. Unable to continue with install: StorageClass "demo-sc" in namespace "" exists and cannot be imported into the current release: invalid ownership metadata; label validation error: missing key "app.kubernetes.io/managed-by&qu
Read more

Configuration and setting-up of AIDE on RHEL6

AIDE is a powerful package for checking integrity of files on a machine/system. Prerequisites : Just aide package. [root@sunny ~]# yum install aide -y Loaded plugins: refresh-packagekit, rhnplugin This system is not registered with RHN.                                                                         RHN support will be disabled. Setting up Install Process Resolving Dependencies --> Running transaction check ---> Package aide.x86_64 0:0.14-3.el6 set to be updated --> Finished Dependency Resolution Dependencies Resolved ================================================================================  Package         Arch              Version               Repository        Size ================================================================================ Installing:  aide            x86_64            0.14-3.el6            local            123 k Transaction Summary =============================================================
Read more