Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #165466 > unrolled thread

Password protecting grub

Back to article view | Back to linux.debian.user

Contents

  Password protecting grub Himanshu Shekhar <irm2015006@iiita.ac.in> - 2016-03-16 12:40 +0100
    Re: Password protecting grub jdd <jdd@dodin.org> - 2016-03-16 13:10 +0100
      Re: Password protecting grub Himanshu Shekhar <irm2015006@iiita.ac.in> - 2016-03-16 13:20 +0100
        Re: Password protecting grub jdd <jdd@dodin.org> - 2016-03-16 13:30 +0100
          Re: Password protecting grub <tomas@tuxteam.de> - 2016-03-16 13:50 +0100
    Re: Password protecting grub <tomas@tuxteam.de> - 2016-03-16 13:30 +0100
    Re: Password protecting grub David Wright <deblis@lionunicorn.co.uk> - 2016-03-16 15:30 +0100
      Re: Password protecting grub Himanshu Shekhar <irm2015006@iiita.ac.in> - 2016-03-16 17:30 +0100
        Re: Password protecting grub arian <debian@semioptimal.net> - 2016-03-16 17:40 +0100
        Re: Password protecting grub jdd <jdd@dodin.org> - 2016-03-16 18:00 +0100
          Re: Password protecting grub Himanshu Shekhar <irm2015006@iiita.ac.in> - 2016-03-16 18:50 +0100
            Re: Password protecting grub Raj Kiran Grandhi <grajkiran@gmail.com> - 2016-03-17 07:30 +0100
              Re: Password protecting grub David Wright <deblis@lionunicorn.co.uk> - 2016-03-17 18:00 +0100
                Re: Password protecting grub Raj Kiran Grandhi <grajkiran@gmail.com> - 2016-03-18 14:40 +0100
                  Re: Password protecting grub David Wright <deblis@lionunicorn.co.uk> - 2016-03-18 16:30 +0100
            Re: Password protecting grub Adam Wilson <moxalt@riseup.net> - 2016-03-17 17:10 +0100
              Re: Password protecting grub Martin Smith <lists@rakupottery.org.uk> - 2016-03-17 18:10 +0100
                Re: Password protecting grub Lisi Reisz <lisi.reisz@gmail.com> - 2016-03-17 18:40 +0100
        Re: Password protecting grub Adam Wilson <moxalt@riseup.net> - 2016-03-17 17:10 +0100

#165466 — Password protecting grub

[Multipart message — attachments visible in raw view] — view raw

I wish to password protect grub bootloader. I tried the steps available on
online manuals as of RedHat, Ubuntu, etc. All experiments were on a
VirtualBox machine, so my system remains safe. However, I didn't get
success.
Every time I write the line to the config file and run update-grub, I get
the response
"password : command not found".

I made experiments with the following files:
  /etc/grub.d/00_header
  /etc/grub.d/40_custom
  /boot/grub/grub.cfg

adding
" set superusers="root"
  password root rootpassword
"
or
" password mypassword "
or
" password --md5 $$$%#$ "

different times. Each time, I had the same error generated.

My current system, where changes are expected has Debian Stretch on a UEFI
installation. So, I have no idea whether the things are same or different
for UEFI and Legacy.
Also, when I tried to install grub (for grub-md5-crypt), it asked to remove
grub-efi and install grub-pc, grub-legacy and their team.
I need EFI because I have Windows as dual boot, I haven't used for long,
but I still want to retain it.

Regards
Himanshu Shekhar

[toc] | [next] | [standalone]

#165467

Le 16/03/2016 12:37, Himanshu Shekhar a écrit :

> " set superusers="root"
>    password root rootpassword

if it's a bash command, it should be "passwd", not "password"

jdd

[toc] | [prev] | [next] | [standalone]

#165468

[Multipart message — attachments visible in raw view] — view raw

On Wed, Mar 16, 2016 at 5:39 PM, jdd <jdd@dodin.org> wrote:

> Le 16/03/2016 12:37, Himanshu Shekhar a écrit :
>
> " set superusers="root"
>>    password root rootpassword
>>
>
> if it's a bash command, it should be "passwd", not "password"
>
> jdd
>
>
Tried! Didn't work.

Regards

[toc] | [prev] | [next] | [standalone]

#165469

Le 16/03/2016 13:16, Himanshu Shekhar a écrit :
> On Wed, Mar 16, 2016 at 5:39 PM, jdd <jdd@dodin.org
> <mailto:jdd@dodin.org>> wrote:
>
>     Le 16/03/2016 12:37, Himanshu Shekhar a écrit :
>
>         " set superusers="root"
>             password root rootpassword
>
>
>     if it's a bash command, it should be "passwd", not "password"
>
>     jdd
>
>
> Tried! Didn't work.
>
> Regards
well... it may be simply a variable for grub. I never used it.

I guess you read this page or some similar:

http://superuser.com/questions/488275/grub-2-password-protection-in-debian

may be insert "echo message" lines to see where is the problem exactly?

sorry to can't be of better help :-)

jdd

[toc] | [prev] | [next] | [standalone]

#165473

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Wed, Mar 16, 2016 at 01:27:40PM +0100, jdd wrote:
> Le 16/03/2016 13:16, Himanshu Shekhar a écrit :
> >On Wed, Mar 16, 2016 at 5:39 PM, jdd <jdd@dodin.org
> ><mailto:jdd@dodin.org>> wrote:
> >
> >    Le 16/03/2016 12:37, Himanshu Shekhar a écrit :
> >
> >        " set superusers="root"
> >            password root rootpassword
> >
> >
> >    if it's a bash command, it should be "passwd", not "password"
> >
> >    jdd
> >
> >
> >Tried! Didn't work.
> >
> >Regards
> well... it may be simply a variable for grub. I never used it.
> 
> I guess you read this page or some similar:
> 
> http://superuser.com/questions/488275/grub-2-password-protection-in-debian
> 
> may be insert "echo message" lines to see where is the problem exactly?

If I understand it correctly, the stdout of these scripts end up
as a command stream for grub. So echo might be the wrong idea.

Perhaps echo to stderr...

regards
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlbpTWoACgkQBcgs9XrR2kb5awCbBrZZ4/VyWYkVbKZvtSQoJYZf
0WoAnRA1RMX5kZxCF6/fbX5XXihcJKo9
=GZwY
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#165470

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Wed, Mar 16, 2016 at 05:07:33PM +0530, Himanshu Shekhar wrote:
> I wish to password protect grub bootloader. I tried the steps available on
> online manuals as of RedHat, Ubuntu, etc. All experiments were on a
> VirtualBox machine, so my system remains safe. However, I didn't get
> success.
> Every time I write the line to the config file and run update-grub, I get
> the response
> "password : command not found".
> 
> I made experiments with the following files:
>   /etc/grub.d/00_header
>   /etc/grub.d/40_custom
>   /boot/grub/grub.cfg
> 
> adding
> " set superusers="root"
>   password root rootpassword
> "
> or
> " password mypassword "
> or
> " password --md5 $$$%#$ "
> 
> different times. Each time, I had the same error generated.

Note that those files are shell scripts generating scripts for grub. I think
you want the shell script outputting something like

  +----------------------
  |set superusers="foo"
  |password foo verytopsecret
  +----------------------

to its standard output, so you'll want to add

  +----------------------
  |cat <<EOF
  |set superusers="foo"
  |password foo verytopsecret
  |EOF
  +----------------------

to your /etc/grub.d/00_header. Rube Goldberg in action, but hey. I wonder
what's in store with Grub3: write a Haskell program which outputs a
shell program which outputs a Grub3 script?

Hope that helps
- -- tomás
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlbpR4oACgkQBcgs9XrR2kaEgQCeKy5u+q+Zv7AIVK1Z2vQcHoHq
s6MAnifV5eAFBhiI3AvHYY2U3T4f2mB2
=0KKO
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#165479

On Wed 16 Mar 2016 at 17:07:33 (+0530), Himanshu Shekhar wrote:
>    I wish to password protect grub bootloader. I tried the steps available on
>    online manuals as of RedHat, Ubuntu, etc. All experiments were on a
>    VirtualBox machine, so my system remains safe. However, I didn't get
>    success. 
>    Every time I write the line to the config file and run update-grub, I get
>    the response 
>    "password : command not found".
>    I made experiments with the following files:
>      /etc/grub.d/00_header
>      /etc/grub.d/40_custom
>      /boot/grub/grub.cfg
>    adding 
>    " set superusers="root" 
>      password root rootpassword
>    "
>    or 
>    " password mypassword "
>    or 
>    " password --md5 $$$%#$ "
>    different times. Each time, I had the same error generated.
>    My current system, where changes are expected has Debian Stretch on a UEFI
>    installation. So, I have no idea whether the things are same or different
>    for UEFI and Legacy. 

Nor me. I can only look at jessie/wheezy on BIOS. However...

You've modified three files at various times with three changes.
In particular, look at your changing /boot/grub/grub.cfg and then
running update-grub. update-grub will immediately overwrite
/boot/grub/grub.cfg so your change should be irrelevant. Because
you saw an error message, you must have left a mistake in one of
the /etc/grub.d/ files.

1) So the first thing to do is to make sure that all these /etc/grub.d/
files are correct. Then stick to modifying /etc/grub.d/40_custom
which is the one provided for that purpose. When you modify it,
make sure you don't change the lines at the top of this file.

2) As an alternative to (1), if those files are screwed but your
/boot/grub/grub.cfg is OK, make your modifications (set superusers
and password) directly to /boot/grub/grub.cfg but don't run
update-grub (which would undo them). When you reboot, the extra
lines will be read and acted upon.

A scenario that could give the symptoms you describe:
Modifying /etc/grub.d/40_custom but messing up the top few lines
by inserting "password user1 insecure-password" into it.
Now, whenever update-grub runs, it will try and execute the command
"password" rather than writing that line into /boot/grub/grub.cfg.

BTW the advice from jdd was poor. You don't want to be running
the real passwd command in this context. As you say you've tried
that, you should check that you haven't unintentionally changed
any passwords; unlikely, I know, as there's normally an exchange
of dialogue involved.

>    Also, when I tried to install grub (for grub-md5-crypt), it asked to
>    remove grub-efi and install grub-pc, grub-legacy and their team.
>    I need EFI because I have Windows as dual boot, I haven't used for long,
>    but I still want to retain it.

I can't help you there. My jessie has
grub2_2.02~beta2-22+deb8u1
grub2-common_2.02~beta2-22+deb8u1
grub-common_2.02~beta2-22+deb8u1
grub-pc_2.02~beta2-22+deb8u1
grub-pc-bin_2.02~beta2-22+deb8u1
and wheezy has
grub2-common_1.99-27+deb7u3
grub-common_1.99-27+deb7u3
grub-pc_1.99-27+deb7u3
grub-pc-bin_1.99-27+deb7u3
and I don't know why you would get offered anything as old as 0.97-67/70.

Cheers,
David.

[toc] | [prev] | [next] | [standalone]

#165491

[Multipart message — attachments visible in raw view] — view raw

I made all possible tries that came to my head with all your suggestions.
Still, password : command not found.

However, I think all of use should use grub-password, especially when we
use mobile systems (as laptops), *UNLESS YOU USE A BIOS PASSWORD*. You can
check Google for what to do when you forget root password (perhaps, you all
know about that). That's just simple to give root access to anyone with
physical possession of the system.

I personally don't like BIOS passwords, because you have no simple way if
you forget them. In fact, if you forget the root password, or even
password, there remains an option for Live system, or complete Format in
case the disk is encrypted. But, no way out if you forget the BIOS password.

That's why I want to have GRUB password. Please tell some other way, you
know or you have tried.
I have done much googling on the topic, and still can't conclude.
I am going to try now with Debian Stretch installed in VirtualBox in EFI
mode. Let's see how far I go.

[toc] | [prev] | [next] | [standalone]

#165493

[Multipart message — attachments visible in raw view] — view raw

hi

> But, no way out if you forget the BIOS password. That's why I want to have GRUB password. 

You realize that if it's easy for you to circumvent some (broken!) authentication, it's just as easy for an attacker, right? What you want is not possible, in the end. I guess that's why "factory reset" on "mobile devices" in many cases deletes storage and disables authentication - less chance for personal data to get in the hand of attackers.

[toc] | [prev] | [next] | [standalone]

#165494

Le 16/03/2016 17:21, Himanshu Shekhar a écrit :

> That's why I want to have GRUB password. Please tell some other way, you
> know or you have tried.

such thing is only useful to prevent (young) child or random people to 
make inadvertent damage, because any real attacker can defeat such pass 
in a snap. BIOS pass have all backdoors one can find on the net.

the only effective way to protect your computer is encrypting the partitions

jdd

[toc] | [prev] | [next] | [standalone]

#165497

[Multipart message — attachments visible in raw view] — view raw

Ok! I understand GRUB password and other such passwords are ineffective. I
am also aware of the fact that hard drive can be read anywhere unless it is
encrypted.
The am eager to know a particular way (however bad it may be) to secure a
system, which I have not known yet.
All efforts yet just stop at one step :
           password : command not found. LOL!

Regards
Himanshu Shekhar

[toc] | [prev] | [next] | [standalone]

#165520

[Multipart message — attachments visible in raw view] — view raw

I have been trying to achieve something similar on my system. Password
protection in grub2 appears to be quite different from that in grub-legacy.

In grub2, authentication is activated by the lines (from the grub info
manual, the section on security):

set superusers="root"
password_pbkdf2 root grub.pbkdf2.sha512.10000.biglongstring

in the /boot/grub/grub.cfg file

The command grub-mkpasswd-pbkdf2 can be used to generate the password.

On debian systems, it is better to put those two lines in
/etc/grub.d/40_custom to make sure that your changes remain after an
`update-grub' command.

But, be advised that once you do this, all the menu entries in grub will be
inaccessible until the password is supplied.
It would be nice to have a way of requiring a password only if it required
to boot a non-default entry.

On Wed, Mar 16, 2016 at 11:12 PM, Himanshu Shekhar <irm2015006@iiita.ac.in>
wrote:

> Ok! I understand GRUB password and other such passwords are ineffective. I
> am also aware of the fact that hard drive can be read anywhere unless it is
> encrypted.
> The am eager to know a particular way (however bad it may be) to secure a
> system, which I have not known yet.
> All efforts yet just stop at one step :
>            password : command not found. LOL!
>
> Regards
> Himanshu Shekhar
>

[toc] | [prev] | [next] | [standalone]

#165549

On Thu 17 Mar 2016 at 11:52:36 (+0530), Raj Kiran Grandhi wrote:
> I have been trying to achieve something similar on my system. Password
> protection in grub2 appears to be quite different from that in grub-legacy.

... and did you succeed?

> In grub2, authentication is activated by the lines (from the grub info
> manual, the section on security):
> 
> set superusers="root"
> password_pbkdf2 root grub.pbkdf2.sha512.10000.biglongstring
> 
> in the /boot/grub/grub.cfg file

Well, my recommendation was to use the unencrypted version until the
OP was successful at getting grub to see it and act upon it. This
prevents any hashing mishaps complicating the issue; one step at
a time.

> The command grub-mkpasswd-pbkdf2 can be used to generate the password.
> 
> On debian systems, it is better to put those two lines in
> /etc/grub.d/40_custom to make sure that your changes remain after an
> `update-grub' command.

"put those two lines in":
As I pointed out, it's very important to place those lines carefully,
obeying the instructions at the top of the file (if they haven't
already been mangled out of existence).

Unfortunately the OP keeps reporting the same old error message
(with LOL) but never posts what's in which file. This makes it hard to help.

> But, be advised that once you do this, all the menu entries in grub will be
> inaccessible until the password is supplied.
> It would be nice to have a way of requiring a password only if it required
> to boot a non-default entry.

That's what
      menuentry "May be run by any user" --unrestricted {
is for. The documentation example runs thus:

set superusers="root"
password_pbkdf2 root grub.pbkdf2.sha512.10000.biglongstring
password user1 insecure

menuentry "May be run by any user" --unrestricted {
	  set root=(hd0,1)
	  linux /vmlinuz
}

menuentry "Superusers only" --users "" {
	  set root=(hd0,1)
	  linux /vmlinuz single
}

menuentry "May be run by user1 or a superuser" --users user1 {
	  set root=(hd0,2)
	  chainloader +1
}

Cheers,
David.

[toc] | [prev] | [next] | [standalone]

#165576

[Multipart message — attachments visible in raw view] — view raw

> > But, be advised that once you do this, all the menu entries in grub will
> be
> > inaccessible until the password is supplied.
> > It would be nice to have a way of requiring a password only if it
> required
> > to boot a non-default entry.
>
> That's what
>       menuentry "May be run by any user" --unrestricted {
> is for. The documentation example runs thus:
>
>
Yes, I had read through that. But that would mean editing
/boot/grub/grub.cfg manually and losing the changes every time grub-update
is run. What I could not figure out was to having the --unrestricted be
appended automatically for the default entry (In my case, GRUB_DEFAULT=0
which boots the default kernel) every time grub-update was run.

An alternate and equally acceptable solution for me would be to require a
password only to a access the grub console or to edit the menu entries
interactively during boot. I had such a setup back when grub-legacy was the
default in debian but could not achieve the same results with grub2.

[toc] | [prev] | [next] | [standalone]

#165579

On Fri 18 Mar 2016 at 18:59:39 (+0530), Raj Kiran Grandhi wrote:
> > > But, be advised that once you do this, all the menu entries in grub will
> > be
> > > inaccessible until the password is supplied.
> > > It would be nice to have a way of requiring a password only if it
> > required
> > > to boot a non-default entry.
> >
> > That's what
> >       menuentry "May be run by any user" --unrestricted {
> > is for. The documentation example runs thus:
> >
> >
> Yes, I had read through that. But that would mean editing
> /boot/grub/grub.cfg manually and losing the changes every time grub-update
> is run. What I could not figure out was to having the --unrestricted be
> appended automatically for the default entry (In my case, GRUB_DEFAULT=0
> which boots the default kernel) every time grub-update was run.

You've just appended
    set superusers=...
    password ...
to the end of /etc/grub.d/40_custom so carry on typing and add your
    unrestricted/default entry right there:

    set superusers=...
    password ...
    menuentry "May be run by any user" --unrestricted { ...
    ...

Obviously change "May be run by any user" into a more convenient and
obvious string like "normal" and give that name to grub-set-default so
that it gets written into the /boot/grub/grubenv file. (Check that.)
I'm assuming you've got GRUB_DEFAULT=saved in your /etc/default/grub
file (and that you refuse any automatic updating of that file).

Cheers,
David.

[toc] | [prev] | [next] | [standalone]

#165540

On Wed, 16 Mar 2016 23:12:06 +0530 Himanshu Shekhar
<irm2015006@iiita.ac.in> wrote:

> Ok! I understand GRUB password and other such passwords are
> ineffective. I am also aware of the fact that hard drive can be read
> anywhere unless it is encrypted.
> The am eager to know a particular way (however bad it may be) to
> secure a system, which I have not known yet.

A BIOS password and full disk encryption.

[toc] | [prev] | [next] | [standalone]

#165550

On 17/03/2016 04:55, Adam Wilson wrote:
> On Wed, 16 Mar 2016 23:12:06 +0530 Himanshu Shekhar
> <irm2015006@iiita.ac.in> wrote:
>
>> Ok! I understand GRUB password and other such passwords are
>> ineffective. I am also aware of the fact that hard drive can be read
>> anywhere unless it is encrypted.
>> The am eager to know a particular way (however bad it may be) to
>> secure a system, which I have not known yet.
> A BIOS password and full disk encryption.
>
>
on all the older machines that I used to make if you had physical access
to the machine you could lose the bios password quite easily with a jumper
or a screwdriver, I dont know what the more modern motherboards are like
but surely they could also be similar...

-- 
Martin

[toc] | [prev] | [next] | [standalone]

#165552

On Thursday 17 March 2016 17:04:04 Martin Smith wrote:
> On 17/03/2016 04:55, Adam Wilson wrote:
> > On Wed, 16 Mar 2016 23:12:06 +0530 Himanshu Shekhar
> >
> > <irm2015006@iiita.ac.in> wrote:
> >> Ok! I understand GRUB password and other such passwords are
> >> ineffective. I am also aware of the fact that hard drive can be read
> >> anywhere unless it is encrypted.
> >> The am eager to know a particular way (however bad it may be) to
> >> secure a system, which I have not known yet.
> >
> > A BIOS password and full disk encryption.
>
> on all the older machines that I used to make if you had physical access
> to the machine you could lose the bios password quite easily with a jumper
> or a screwdriver, I dont know what the more modern motherboards are like
> but surely they could also be similar...

Most, but not all.  Some of them, (a small number of them?) you lose the 
password, the motherboard is dead.

Lisi

[toc] | [prev] | [next] | [standalone]

#165533

On Wed, 16 Mar 2016 21:51:02 +0530 Himanshu Shekhar
<irm2015006@iiita.ac.in> wrote:

> I made all possible tries that came to my head with all your
> suggestions. Still, password : command not found.
> 
> However, I think all of use should use grub-password, especially when
> we use mobile systems (as laptops), *UNLESS YOU USE A BIOS PASSWORD*.
> You can check Google for what to do when you forget root password
> (perhaps, you all know about that). That's just simple to give root
> access to anyone with physical possession of the system.
> 
> I personally don't like BIOS passwords, because you have no simple
> way if you forget them. In fact, if you forget the root password, or
> even password, there remains an option for Live system, or complete
> Format in case the disk is encrypted. But, no way out if you forget
> the BIOS password.

Your rationale for using a GRUB password doesn't make much sense. You
want password-protection earlier on than login to protect your system,
yet you don't want a BIOS password because it is harder to work around
than a GRUB password.

If you want security, use a BIOS password.

If you want convenience, don't use any pre-login passwords.

I don't really see where a GRUB password fits in to the paradigm.

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web