Protect the boot loader configuration with a password

Description

GRUB can require a superuser name and password before anyone edits a boot entry or opens the GRUB command line. The password is stored as a PBKDF2 hash in the GRUB configuration. Marking the normal boot entries --unrestricted keeps unattended boots working: the password is only asked to change them.

Full disk encryption is the stronger protection against offline attacks. The GRUB password does not protect against booting another medium; restrict that in the firmware settings.

/etc/grub.d/10_linux is a configuration file of the grub-common package: an upgrade that changes it keeps the local version (unattended-upgrades) or asks. After such an upgrade, check that --unrestricted is still on the CLASS= line.

Rationale

Whoever reaches the console (physically, through a hypervisor console or a remote management card) can otherwise edit the kernel command line, boot into single-user mode or a shell, and bypass every account and audit control of the system.

Impact

Editing boot entries or using the GRUB shell during an incident needs the GRUB password. Store it with the other break-glass secrets. Boots without changes are not affected.

Applies when

Detected: when: GRUB is the boot loader A scanner reports the control not applicable when one is false.

Setting

Audit

In /boot/grub/grub.cfg, check that a set superusers= line and a password_pbkdf2 line exist.

Automated: every check must pass. Scanners report each check by its id.

superusers

A GRUB superuser is declared.

path: /boot/grub/grub.cfg
pattern: ^\s*set\s+superusers=

password

The superuser has a PBKDF2 password.

path: /boot/grub/grub.cfg
pattern: ^\s*password_pbkdf2\s+

Remediation

1. Generate a hash: grub-mkpasswd-pbkdf2.
2. Append to /etc/grub.d/40_custom:

   set superusers="root"
   password_pbkdf2 root grub.pbkdf2.sha512.10000.<hash>
   

3. To keep normal boots unattended, add --unrestricted to the CLASS= line of /etc/grub.d/10_linux, or to each menuentry you want bootable without a password.
4. Run update-grub, then reboot once from the console to confirm the default entry still boots.

Rollback

Remove the two lines from /etc/grub.d/40_custom and run update-grub.

References

• grub-mkpasswd-pbkdf2(1), Ubuntu manual pages Canonical, vendor-doc, accessed 2026-10-19
• GNU GRUB Manual - Authentication and authorisation GNU Project, vendor-doc, accessed 2026-10-19
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R5) ANSSI, guide, accessed 2026-10-19

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle