13

I am making installation for school computers. I would like to remove single user mode booting, which can make student root user. How to permanently remove single user / recovery mode from GRUB? I am also concerned with updating kernel (update-grub)

I DO need GRUB for booting into Windows installation.

Improve this question
3
  • 1
    Does this askubuntu.com/a/78051/71679 answer and others on that question help with what you wanted?
    – damien
    Sep 10, 2012 at 14:50
  • 3
    Note, however, that once a student has physical access to the machine, there is hardly a way of completely securing it. You switch on BIOS password, make sure the computer cannot be booted from a CD-ROM, install grub with a password (see the link in the comment above) etc., but unless you physically lock the case there will Always Be A Way.
    – January
    Sep 10, 2012 at 14:54
  • thanks damien! I think i will try passowd. Also bios is already protected with password (but didn't yet research if boot key can be disabled) (btw, what to do with question since it's solved in comments?)
    – gsedej
    Sep 10, 2012 at 17:34

2 Answers 2

Reset to default
16

  1. Open a terminal with Ctrl+Alt+T shortcut and type this command and then hit Enter.

    gksu gedit /etc/default/grub

  2. The above command will open GRUB default file in gedit text editor. Search for a section like this one: 

    # Uncomment to disable generation of recovery mode menu entries
#GRUB_DISABLE_RECOVERY="true"

  3. Remove the # mark from the line #GRUB_DISABLE_RECOVERY="true". The changed section should look like this:

    # Uncomment to disable generation of recovery mode menu entries
GRUB_DISABLE_RECOVERY="true"

    Save the file by pressing Ctrl+S, then exit gedit.

  4. Then again going to the terminal, execute the below command:

    sudo update-grub

Restart to see that the recovery option has gone.

Improve this answer
3
  • 4
    I can still open grub parameters editor and add init=/bin/bash to boot my system in root shell. How can I disable this?
    – fabda01
    Aug 17, 2018 at 14:23
  • 1
    Real answer: askubuntu.com/a/1357691/21315
    – Smile.Hunter
    Aug 13, 2021 at 1:09
  • @fabda01 The two steps are disabling GRUB recovery mode, and securing GRUB menu editing and GRUB terminal with a password. help.ubuntu.com/community/Grub2/Passwords was very helpful with the password part. I have heard of adding a password to GRUB recovery mode, but I am not sure if that is needed if the flag to disable it is set to "true".
    – King Holly
    Apr 2, 2022 at 3:55
5

Its important to remember as january mentioned that once someone has access to the machine it becomes very hard to completely secure it.

Information about grub2 password protection and password protecting recovery mode can be found here https://askubuntu.com/a/78051/71679

Some additional information that may be of interest in your case would be to look at the Bastille hardening program https://help.ubuntu.com/community/BastilleLinux and here http://www.bastille-unix.org/Reporting/assessment-report.html

Also you may be interested in the edubuntu version that includes LTSP. In an LTSP thin client environment, all software for workstations originates on the LTSP server. Whether you are repurposing old desktop PCs or deploying new thin client devices. LTSP allows you to maintain your entire computer network from a single point of control; from the operating system image on the thin clients through user authentication and file storage. By reducing your software footprint with LTSP, maintenance and support obligations are reduced when compared to traditional desktop PC computing solutions.

edubuntu http://www.edubuntu.org/ and more information about LTSP http://www.ltsp.org

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .