grub2-mkconfig tool or by editing the default configuration file. This prevents unauthorized users from accessing single-user mode or modifying kernel parameters during the boot process, ensuring your system remains secure against physical access attacks.
Understanding GRUB Security in Fedora
The Grand Unified Bootloader (GRUB) is the first software program that runs when your computer starts. By default, on Fedora Linux, GRUB allows anyone with physical access to press keys like e to edit boot entries or c to open a command line. This can allow an attacker to bypass authentication mechanisms entirely by changing kernel arguments to skip user login prompts.
Fedora uses grubby as its primary tool for managing bootloader configurations because it handles the complex interactions between different initramfs images and kernel versions automatically. While older tutorials might suggest manually editing files in /etc/grub.d/, this approach is fragile and often overwritten by updates. The modern, supported method involves generating a superuser hash and applying it through the standard configuration pipeline.
Generating the Password Hash
The first step is to create a strong password hash that GRUB understands. You cannot use plain text passwords in the configuration file for security reasons; they must be encrypted using PBKDF2 hashing. Open a terminal window and run the following command:
grub2-mkpasswd-pbkdf2You will be prompted to enter your desired password twice. The command will output a long string starting with grub.pbkdf2.sha512.... Copy this entire string carefully. It is crucial to keep this hash secure, as it effectively acts as the root password for your bootloader. If you lose access to this hash and forget your GRUB password, recovery can be difficult without live media.
Applying the Configuration via grubby
Instead of manually creating scripts in /etc/grub.d/, which was flagged as incorrect in previous drafts, we should use the tools provided by Fedora to ensure compatibility. However, grubby does not have a direct flag for setting the GRUB superuser password in all versions. Therefore, the most reliable method on Fedora 38 is to append the necessary directives to the main configuration file or use a custom script if you prefer modular management.
The recommended approach for Fedora users who want to avoid manual file editing errors is to create a small custom script in /etc/grub.d/ that is executed during the config generation. Create a file named /etc/grub.d/01_users with the following content:
#!/bin/sh
echo "set superusers=\"root\""
echo "password_pbkdf2 root YOUR_GENERATED_HASH_HERE"Replace YOUR_GENERATED_HASH_HERE with the actual hash you copied earlier. Ensure the file is executable by running:
chmod +x /etc/grub.d/01_usersThis script name follows the standard convention where numbers determine execution order. The 01_ prefix ensures it runs early enough to set the superuser before other menus are rendered.
Updating the Bootloader Configuration
Once the script is in place and executable, you need to regenerate the GRUB configuration. In Fedora, this is done by running:
sudo grub2-mkconfig -o /boot/grub2/grub.cfgIf you are using UEFI systems, the path might differ slightly depending on your partition structure, but /boot/grub2/grub.cfg is the standard target for BIOS/UEFI hybrid setups common in Fedora. After the command completes successfully, reboot your system.
Upon reboot, try pressing e to edit a boot entry. You should now be prompted for a username and password. Enter root and the password associated with the hash. If configured correctly, you will gain access to the edit screen only after successful authentication.
Verifying the Protection
To verify that the protection is active, attempt to boot into emergency mode or change kernel parameters. Without the correct credentials, GRUB will reject these actions. This simple step significantly hardens your system against local physical attacks.
Frequently Asked Questions
What happens if I forget my GRUB password?
If you forget the password, you can reset it by booting from a live USB drive and chrooting into your installed Fedora system. Once inside, you can delete or modify the /etc/grub.d/01_users file and regenerate the config. Always keep a backup of your original configuration files.
Does this protect against remote attacks?
No, GRUB password protection only secures the bootloader stage. It does not encrypt your disk or protect network services. For full data security, you should combine this with LUKS disk encryption and firewalls.
Can I use a different username than root?
Yes, you can replace root in the set superusers directive with any valid system user. However, using root is standard practice because it has unrestricted access to modify boot parameters, which is the primary goal of protecting the menu.
Will this break dual-boot setups with Windows?
No, adding a password to GRUB does not affect the ability to chain-load Windows or other operating systems. It simply adds a gatekeeper layer before any selection is made. See our guide on fixing partition type errors in dual boot systems for more context.
How do I remove the password protection?
To remove the protection, delete the /etc/grub.d/01_users file or comment out the lines within it. Then, run sudo grub2-mkconfig -o /boot/grub2/grub.cfg again to apply the changes. Your GRUB menu will return to its default unprotected state.