How to Secure the GRUB Bootloader with a Password in Ubuntu Linux

Why Secure the GRUB Bootloader?

Physical security is just as important as network security. If a malicious actor gains physical access to your Ubuntu Linux server, they can easily reboot the machine, interrupt the GRUB boot menu, and boot into single-user mode (or modify the init parameters). Once they have a root shell, they can easily reset the root password and take complete control of the system.

To prevent this, administrators must secure the GRUB bootloader with a password. This ensures that no one can edit boot parameters or boot into recovery modes without authenticating first, effectively neutralizing physical console attacks.

Step 1: Generate an Encrypted Password

Never store passwords in plain text. We must generate a PBKDF2 encrypted hash of your desired password using a built-in GRUB utility.

Open your terminal and execute the following command:

grub-mkpasswd-pbkdf2

You will be prompted to enter and confirm your desired GRUB password. The output will look something like this:

PBKDF2 hash of your password is grub.pbkdf2.sha512.10000.E1F...

Copy the entire string starting with grub.pbkdf2... to your clipboard.

Step 2: Configure the GRUB Custom File

Now we need to tell GRUB to require this password. We will do this by editing a custom configuration file in the GRUB directory.

sudo nano /etc/grub.d/40_custom

Scroll to the very bottom of the file and append the following lines. Replace grubadmin with a username of your choice, and paste your encrypted hash at the end of the second line:

set superusers="grubadmin"
password_pbkdf2 grubadmin [PASTE_YOUR_HASH_HERE]

Save and close the file (Ctrl+O, Enter, Ctrl+X).

Step 3: Allow Normal Booting (Optional but Recommended)

By default, adding a superuser to GRUB restricts everything, meaning the server will not even boot the default operating system without someone physically typing the password. If this is a remote server, it will hang indefinitely on reboot.

To allow the server to boot normally unattended, but require a password to edit the entries, you must add the --unrestricted flag to your main OS entries. Open the primary configuration file:

sudo nano /etc/grub.d/10_linux

Locate the lines that generate the menu entries (usually starting with menuentry) and add --unrestricted right after the menu entry name.

Note: If you want maximum security and don’t mind typing the password on every single boot, you can skip this step.

Step 4: Update GRUB

Finally, compile the new configuration so it takes effect on the next boot.

sudo update-grub

The next time the system reboots, anyone attempting to press e to edit the boot parameters or access advanced recovery modes will be immediately challenged for the grubadmin username and password.