0

When you start the machine and press shift to bring up grub menu, and you press e to make changes in the menu that starts off with setparams 'Ubuntu, with Linux 3.16.0-30genric', how do you prevent people from making changes to that menu like adding ro recovery nomodeset

8
  • It's not because I've done that and it still doesn't stop me from changing what a hacker would need to bypass that. Aug 5, 2015 at 17:29
  • So you're saying you set a password for entry, but was able to edit and boot that entry?
    – muru
    Aug 5, 2015 at 17:31
  • No what I'm say is when boot and you press advanced options then press e to make changes to the text I can still do that, I don't want to be able to do that needs to be password protected. Aug 5, 2015 at 17:42
  • What difference does that make, when you still can't boot from the modified entry?
    – muru
    Aug 5, 2015 at 17:43
  • because when you change the splash line to ro recover nomodeset you can still get to root thats why I want the menu before password protected Aug 5, 2015 at 17:44

1 Answer 1

5

If you look at this page here in the Superuser & Password Designation section, you will see that it specifically states that:

Note: GRUB 2 1.99 in 12.04 LTS doesn't protect submenu, ie. command line, entry editing and access to entries is not protected! See bug 718670.

However, they claim that the work around would be to add export superusers to the /etc/grub.d/00_header file. The example looks like the following lines added to the bottom of the file:

cat << EOF
set superusers="user1"
password user1 password1
export superusers
EOF

after those lines are added to your user information, update the grub so the settings take effect:

sudo update-grub

I just tested this on my own system, and as soon as I selected Advanced Options it asked for a username and password. However, once you type it in, it is stored for that session and you can edit all lines, even the main Ubuntu entry. If I rebooted the system, then pressed e on the first entry of Ubuntu, it asked for the username and password.

NOTE: this does not protect if someone boots the host to Live media. The only way to protect against that would be to use full drive encryption, but that is for a whole other topic.

Hope this helps!

Not the answer you're looking for? Browse other questions tagged .