0

I recently came across the Linux password change method via the GRUB by entering single user mode. After some digging around I found some articles on how to secure it with a sha512 hashed password.While this sounds like a good option to secure GRUB I also read you can simply change it using a Linux installation.

So how can you go about securing the password in a way that cannot be modified or removed through the use of a Linux installation?

Improve this question
2
  • What is your use case? Why would I (read: an attacker) care about your grub password if I could just mount the harddrive directly? Commented May 30, 2022 at 7:32
  • The use case is less important as this is a study on potential remediation and vulnerabilities around this method of resetting the password. While an attacker could potentially just mount the hard drive directly, it is a different discussion of how to remediate that. Rather the current question is only on how to prevent the bypass of an applied GRUB password through a Linux installation. Commented May 30, 2022 at 8:22

1 Answer 1

Reset to default
1

So how can you go about securing the password in a way that cannot be modified or removed through the use of a Linux installation?

This is not possible. If someone has physical access to your device, they can do everything. You have two options:

  1. Encrypt all the partitions and boot from e.g. a USB stick which only you have access to.

  2. With new GRUB releases if you have secure EFI [boot] enabled, you can encrypt all the partitions and leave only the EFI boot partition unecrypted with no GRUB password at all.

    Obviously you'll have to set the password to access BIOS cause otherwise the attacker may disable secure boot or install their own MAC key and tamper with the boot loader and sniff your passwords.

Lastly if someone has physical access to your PC they may tamper with your keyboard and install a hardware keylogger - then all your protections are worthless.

Protecting your device from physical attacks is a very complicated topic. Maybe you should settle on recently released Apple devices or Android phones which do it perfectly. A run of the mill x86 PC/laptop is wide open to all sorts of physical undetectable attacks.

Improve this answer
2
  • Is it safe to say then that enabling a hashed password to protect GRUB is simply an 'additional security layer'? Commented May 30, 2022 at 9:11
  • If only you have physical access to your PC it does nothing except making your life miserable :-) You'll need to enter one extra password on each boot. Commented May 30, 2022 at 9:41

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.