How to Secure GRUB Boot Loader with Password on Ubuntu 22.04

GRUB is the first thing that runs when your computer starts, making it a key part of booting Linux. Setting a password for GRUB helps keep your system safe by stopping unauthorized users from changing boot settings or getting root access. This is especially important for systems that need extra security.

Here’s how you can lock down your GRUB bootloader with a password to keep your system safe from unauthorized changes.

Create a GRUB Password

First, generate a strong password hash for GRUB authentication.

#  grub-mkpasswd-pbkdf2

After running the command, you’ll be asked to enter and confirm a password. Once you do, the system will generate a hashed version of your password for your current user, which will look something like this.

PBKDF2 hash of your password is grub.pbkdf2.sha512.10000.7D90644BD00019D3A3367EF6DE8B44EBDEF1879966DCF0E0300925F25DF5C4   866505A22F661B2249632C850F4E2D4D5B77B972B187FE63EDD08FE6BD732C951D.CC8D9A68ABA39CD9CCEEFCBBDD23A46B2B8EEF3F15FB33F4696B   73493B77089E1AC50A421E9F090D3BFB9830B8A415039A9F9A0E379A346A6F564D764DC8E25F

Copy the full hash—you’ll need it for the next step.

grub.pbkdf2.sha512.10000.7D90644BD00019D3A3367EF6DE8B44EBDEF1879966DCF0E0300925F25DF5C4   866505A22F661B2249632C850F4E2D4D5B77B972B187FE63EDD08FE6BD732C951D.CC8D9A68ABA39CD9CCEEFCBBDD23A46B2B8EEF3F15FB33F4696B   73493B77089E1AC50A421E9F090D3BFB9830B8A415039A9F9A0E379A346A6F564D764DC8E25F

Edit GRUB Configuration

Open the custom GRUB configuration file and add these lines, replacing your_username with your chosen username and [your_generated_hash] with the hashed password you created earlier.

set superusers="your_username"
password_pbkdf2 your_username [your_generated_hash]

# vim /etc/grub.d/40_custom
set superusers="root"
password_pbkdf2 root grub.pbkdf2.sha512.10000.7D90644BD00019D3A3367EF6DE8B44EBDEF1879966DCF0E0300925F25DF5C4   866505A22F661B2249632C850F4E2D4D5B77B972B187FE63EDD08FE6BD732C951D.CC8D9A68ABA39CD9CCEEFCBBDD23A46B2B8EEF3F15FB33F4696B   73493B77089E1AC50A421E9F090D3BFB9830B8A415039A9F9A0E379A346A6F564D764DC8E25F