How to Use GRUB Security to Harden Your Linux Boot

Table of Contents

1. Understanding GRUB and Boot Security
2. Prerequisites
3. Step 1: Set a GRUB Password
4. Step 2: Restrict Menu Editing
5. Step 3: Hide the GRUB Menu
6. Step 4: Secure Kernel Parameters
7. Step 5: Use Secure Boot with GRUB
8. Step 6: Audit and Monitor GRUB Configuration
9. Troubleshooting Common Issues
10. Conclusion
11. References

Understanding GRUB and Boot Security

What is GRUB?

GRUB (GRand Unified Bootloader) is a free, open-source bootloader used by most Linux distributions. It acts as an intermediary between your system’s firmware (BIOS or UEFI) and the operating system, allowing you to select which OS or kernel to boot. Modern Linux systems use GRUB 2 (replacing the older GRUB Legacy), which offers enhanced features like modularity, scripting support, and support for UEFI.

Why GRUB Security Matters

The boot process is a prime target for attackers because:

• Physical Access: An attacker with physical access to your machine can reboot it and interact with GRUB directly.
• Bypassing Encryption: If your root filesystem is encrypted (e.g., with LUKS), an attacker could use GRUB to modify boot parameters and bypass encryption prompts.
• Kernel Tampering: GRUB allows editing kernel command-line parameters at boot (e.g., adding init=/bin/bash to launch a root shell without a password).
• Information Disclosure: The GRUB menu often displays kernel versions and OS details, which attackers can use to exploit known vulnerabilities.

How GRUB Fits Into the Boot Flow

To secure GRUB, it helps to understand where it sits in the boot process:

1. Firmware (BIOS/UEFI): Initializes hardware and checks for a bootable device (e.g., hard drive, SSD).
2. GRUB: Loaded from the bootable device, GRUB presents a menu (or boots automatically) and loads the Linux kernel and initial RAM filesystem (initramfs).
3. Kernel/Initramfs: The kernel initializes the system, and initramfs handles early tasks like decrypting the root filesystem.
4. Root Filesystem: The OS loads, and user authentication begins.

If GRUB is compromised at step 2, attackers can disrupt the entire chain.

Prerequisites

Before hardening GRUB, ensure you have:

• A Linux system running GRUB 2 (check with grub-install --version; most modern distros like Ubuntu 20.04+, Debian 10+, Fedora 30+, and RHEL 8+ use GRUB 2).
• Root access (via sudo or direct root login).
• A backup of your GRUB configuration files:

  sudo cp /etc/default/grub /etc/default/grub.bak  
  sudo cp -r /etc/grub.d/ /etc/grub.d.bak/  

• Basic familiarity with the command line and text editors (e.g., nano, vim).

Step 1: Set a GRUB Password

The most critical GRUB security measure is setting a password. This prevents unauthorized users from editing the GRUB menu or booting into restricted modes.

Why a Password?

By default, GRUB allows anyone with physical access to edit menu entries (via the e key) or boot into single-user mode. A password locks down these actions.

How to Set a GRUB Password

1. Generate a Hashed Password

GRUB stores passwords as hashes (not plaintext) for security. Use grub-mkpasswd-pbkdf2 to generate a PBKDF2-hashed password (PBKDF2 is a secure password-hashing algorithm):

sudo grub-mkpasswd-pbkdf2  

You’ll be prompted to enter and confirm a password. The output will include a hash starting with grub.pbkdf2.sha512.... Save this hash—you’ll need it in the next step.

Example output:

Enter password:  
Reenter password:  
PBKDF2 hash of your password is grub.pbkdf2.sha512.10000.5A3B7C9D... (truncated for brevity)  

2. Add the Password to GRUB Configuration

Edit the 40_custom file (used for custom GRUB settings) to add the password hash:

sudo nano /etc/grub.d/40_custom  

At the bottom of the file, add:

set superusers="root"  # Defines the "superuser" (name can be custom, e.g., "grubadmin")  
password_pbkdf2 root grub.pbkdf2.sha512.10000.5A3B7C9D...  # Replace with your hash  

• superusers: Specifies which user(s) can edit the menu or boot restricted entries.
• password_pbkdf2: Associates the hashed password with the superuser.

3. Update GRUB

Save the file and regenerate the GRUB configuration (grub.cfg):

# For Debian/Ubuntu:  
sudo update-grub  

# For RHEL/CentOS/Fedora:  
sudo grub2-mkconfig -o /boot/grub2/grub.cfg  

4. Test the Password

Reboot your system. When the GRUB menu appears, press e to edit an entry—you should be prompted for the superuser password. If you enter it correctly, editing is allowed; otherwise, access is denied.

Step 2: Restrict Menu Editing

Even with a password, you may want to completely block editing of GRUB entries (e.g., to prevent accidental changes by authorized users).

How to Disable Editing

Edit /etc/default/grub and add/modify the following line:

sudo nano /etc/default/grub  

Add:

GRUB_DISABLE_EDITING=true  

This disables the e key (used for editing) entirely.

Allow Editing for Specific Entries (Advanced)

If you need to allow editing for certain entries (e.g., a recovery kernel), mark them as --unrestricted in /etc/grub.d/10_linux (or your custom menu file). For example:

menuentry 'Ubuntu (Recovery Mode)' --unrestricted {  
  # Kernel and initramfs details...  
}  

Note: This weakens security—use only if necessary.

Apply Changes

Regenerate the GRUB config:

# Debian/Ubuntu:  
sudo update-grub  

# RHEL/CentOS/Fedora:  
sudo grub2-mkconfig -o /boot/grub2/grub.cfg  

Step 3: Hide the GRUB Menu

The GRUB menu displays sensitive information (e.g., kernel versions, OS names) and invites tampering. Hiding it reduces exposure.

How to Hide the Menu

Edit /etc/default/grub and set the following variables:

sudo nano /etc/default/grub  

Add/modify:

GRUB_TIMEOUT=0           # Time (in seconds) to wait before booting the default entry  
GRUB_TIMEOUT_STYLE=hidden # Hide the menu unless a key (e.g., Shift, Esc) is pressed  
GRUB_HIDDEN_TIMEOUT_QUIET=true # Suppress "Press ESC to enter menu" messages  

Exceptions

• Multiple OSes: If you dual-boot (e.g., Linux + Windows), GRUB may still show the menu to let you choose.
• Key Presses: Holding Shift (BIOS) or Esc (UEFI) during boot will still reveal the menu. Combine this with a GRUB password to block access.

Apply Changes

Regenerate the config:

sudo update-grub  # or grub2-mkconfig for RHEL/CentOS  

Step 4: Secure Kernel Parameters

Kernel command-line parameters (e.g., quiet, splash) are set in GRUB. Attackers could add malicious parameters (e.g., single for single-user mode, init=/bin/bash for a root shell) if editing is allowed.

How to Lock Down Parameters

1. Set Safe Defaults: Define allowed parameters in /etc/default/grub using GRUB_CMDLINE_LINUX_DEFAULT:

   GRUB_CMDLINE_LINUX_DEFAULT="quiet splash ro"  # "ro" = root filesystem read-only  

   Avoid dangerous parameters like rw (read-write), single, or init.

2. Prevent Additions: Since you already disabled editing (Step 2), users can’t add new parameters. For extra safety, ensure GRUB_DISABLE_EDITING=true is set.

Apply Changes

Regenerate the config:

sudo update-grub  

Step 5: Use Secure Boot with GRUB

Secure Boot is a UEFI feature that ensures only signed, trusted software (like GRUB and the Linux kernel) runs during boot. It prevents malware from replacing GRUB or the kernel.

How Secure Boot Works with GRUB

• Signing GRUB: GRUB must be signed with a private key, and the corresponding public key must be enrolled in the UEFI firmware.
• Shim Bootloader: Most Linux distros use shim.efi—a Microsoft-signed bootloader that loads GRUB (which is signed by the distro). This avoids requiring users to enroll custom keys.

Enabling Secure Boot

1. Check UEFI Support: Ensure your system uses UEFI (not BIOS) and has Secure Boot enabled in the firmware settings (accessed by pressing F2, Del, or F1 during boot).

2. Verify GRUB is Signed: Distros like Ubuntu, Fedora, and RHEL ship with signed GRUB binaries. Check with:

   sbverify --list /boot/efi/EFI/ubuntu/grubx64.efi  # Ubuntu example  

3. Enroll Custom Keys (Advanced): For custom setups (e.g., self-signed GRUB), use sbsigntool to sign GRUB and enroll the public key in UEFI:

   # Sign GRUB with your key  
   sbsign --key my_private_key.pem --cert my_cert.pem /boot/efi/EFI/<distro>/grubx64.efi  

   Then, enter UEFI settings and enroll my_cert.pem as a trusted key.

Step 6: Audit and Monitor GRUB Configuration

GRUB settings can be modified accidentally or maliciously. Regular audits ensure your hardening measures remain intact.

What to Monitor

• /etc/default/grub: Main GRUB configuration.
• /etc/grub.d/: Scripts that generate the GRUB menu.
• /boot/grub/grub.cfg (or /boot/grub2/grub.cfg): The generated GRUB config.

Tools for Monitoring

• File Hashes: Compute hashes of critical files and check them periodically:

  md5sum /etc/default/grub /boot/grub/grub.cfg > grub_hashes.txt  
  # Later, verify with:  
  md5sum -c grub_hashes.txt  

• AIDE/Tripwire: Use intrusion detection tools like AIDE (Advanced Intrusion Detection Environment) to monitor file changes automatically:

  sudo apt install aide  # Debian/Ubuntu  
  sudo aideinit -B 'database_out=file:/var/lib/aide/aide.db.new.gz'  
  sudo mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz  
  # Check for changes with:  
  sudo aide --check  

Troubleshooting Common Issues

Forgotten GRUB Password

If you lock yourself out, reset the password by:

1. Booting from a Linux live USB.
2. Mounting your root filesystem:

   sudo mount /dev/sda2 /mnt  # Replace /dev/sda2 with your root partition  

3. Chrooting into the mounted system:

   sudo chroot /mnt  

4. Editing /etc/grub.d/40_custom to remove the password entry.
5. Regenerating grub.cfg:

   update-grub  

GRUB Menu Still Appears

• Ensure GRUB_TIMEOUT=0 and GRUB_TIMEOUT_STYLE=hidden are set in /etc/default/grub.
• On dual-boot systems, GRUB may show the menu to list OSes. Combine with a password to secure it.

Password Not Working

• Verify the hash in /etc/grub.d/40_custom matches the output of grub-mkpasswd-pbkdf2.
• Ensure superusers is defined (e.g., set superusers="root").

Conclusion

Securing GRUB is a critical step in hardening your Linux system. By setting a password, restricting editing, hiding the menu, securing kernel parameters, enabling Secure Boot, and monitoring changes, you significantly reduce the risk of boot-time attacks.

Remember: defense in depth is key. Combine GRUB security with full-disk encryption (LUKS), strong user passwords, and physical security (e.g., BIOS/UEFI passwords) for maximum protection.

References

• GRUB 2 Official Documentation
• Ubuntu GRUB Security Guide
• Red Hat Enterprise Linux GRUB 2 Documentation
• Secure Boot on Linux (Arch Wiki)
• LUKS Full-Disk Encryption