4

I recently downloaded the official centos/7 Vagrant Cloud VM. While trying to access its GRUB2 menu during a reboot via the e key, I ran into a prompt for a username + password.

ss1

I was unsuccessful in finding this referred to anywhere on the official page for this VM, in the blog post announcing it, nor in any of these git repos:

Perhaps I modified this at some point and no longer recall the username & password that was used to protect GRUB2's boot menu.

In either case, rather than hunt for this any further, how can I simply change the credentials in GRUB2 to whatever I want?

0

1 Answer 1

6

Since you'll typically have access to root via sudo when you start up your Vagrant VM, you can simply log into it and become root like so:

$ vagrant ssh
$ sudo -Es

Once you're root you can reset the credentials to whatever you want in one of two ways.

RHEL & CentOS 7.2+ & Fedora

Starting with RHEL & CentOS 7.2+ & Fedora there's a helper script/tool, grub2-setpassword, that's included which greatly simplifies the process to do this.

To use it you'd do the following:

$ grub2-setpassword
Enter password:
Confirm password:
$

Once you've done the above the password will automatically be set for you in this file: /boot/grub2/user.cfg:

$ cat /boot/grub2/user.cfg
GRUB2_PASSWORD=grub.pbkdf2.sha512.10000.5A95A11398D5DEAA9B205DCEA37E0FDCC069CF6D0C398E8C9FF2ED1D8DE072DDE1D916F955266C306AAC7CA62E0D29A7C6558F3B29E40008289DBE857B8354CE.DD410AA2E5D6495BA723147046B88B89A585656AF4298F07CBC93E7A4F73713A824AE1F3448F837809B6655861A1BA5F0FB615206470E4228E57F7BCF11442A3

You can look at how this file gets used by GRUB2 on CentOS based distros by looking for it in /etc/grub.d like so:

$ grep -l user.cfg /etc/grub.d/*
/etc/grub.d/01_users

Contents of that file:

$ cat /etc/grub.d/01_users
#!/bin/sh -e
cat << EOF
if [ -f \${prefix}/user.cfg ]; then
  source \${prefix}/user.cfg
  if [ -n "\${GRUB2_PASSWORD}" ]; then
    set superusers="root"
    export superusers
    password_pbkdf2 root \${GRUB2_PASSWORD}
  fi
fi
EOF

Ah so the default user will be 'root'. Good so if we were to reboot our VM and try using the credentials 'root' with the password we supplied to grub2-setpassword:

ss2

We can now get into the menu:

ss3

Ubuntu 16.04+

On other distros that do not provide the script grub2-setpassword the process is a bit more involved, but not terrible.

1. generate an encrypted password

You need to use the GRUB2 tool to encrypt your password:

$ grub-mkpasswd-pbkdf2
Enter password:
Reenter password:
PBKDF2 hash of your password is grub.pbkdf2.sha512.10000.465B5EE2D2F6A767304EB397D6D97C70BC38653F95AFE58B24F190D5DABB0143920F736C125B91FB9F298AFF3D0F8FBBFB8228D5C8C9DD371ADBB1044CC80BFC.52D87AFD47A5BE2D7B6CF755D26CD5F481557DBCF5E725ABA44BF003A2970D3F775E8657428EDC201D86A3DF07D7A8109AFD5764EA058BE94D840F42ED17C3E2

2. Add password to GRUB2 config

and then take the output of that command, grub.pbkdf2.sha512.10000....., and copy/paste it into a file.

$ cat /etc/grub.d/40_custom
#!/bin/sh
exec tail -n +3 $0
# This file provides an easy way to add custom menu entries.  Simply type the
# menu entries you want to add after this comment.  Be careful not to change
# the 'exec tail' line above.

set superusers="root"
password_pbkdf2 root grub.pbkdf2.sha512.10000.465B5EE2D2F6A767304EB397D6D97C70BC38653F95AFE58B24F190D5DABB0143920F736C125B91FB9F298AFF3D0F8FBBFB8228D5C8C9DD371ADBB1044CC80BFC.52D87AFD47A5BE2D7B6CF755D26CD5F481557DBCF5E725ABA44BF003A2970D3F775E8657428EDC201D86A3DF07D7A8109AFD5764EA058BE94D840F42ED17C3E2

NOTE: We're setting the username to 'root', it can be whatever you want. if you change it, be sure to change it on both lines (superusers="root" & password_pbkdf2 root ...).

3. Rebuild GRUB2 grub.cfg

Now we need to regenerate our grub.cfg:

$ grub-mkconfig -o /boot/grub/grub.cfg
Generating grub configuration file ...
Found linux image: /boot/vmlinuz-4.4.0-130-generic
Found initrd image: /boot/initrd.img-4.4.0-130-generic
done

This will take all the contents of /etc/grub.d and incorporate it into a new grub.cfg. So our 40_custom section of grub.cfg will go from this:

$ cat /boot/grub/grub.cfg
...
### BEGIN /etc/grub.d/40_custom ###
# This file provides an easy way to add custom menu entries.  Simply type the
# menu entries you want to add after this comment.  Be careful not to change
# the 'exec tail' line above.
### END /etc/grub.d/40_custom ###
...

To this:

$ cat /boot/grub/grub.cfg
...
### BEGIN /etc/grub.d/40_custom ###
# This file provides an easy way to add custom menu entries.  Simply type the
# menu entries you want to add after this comment.  Be careful not to change
# the 'exec tail' line above.

set superusers="root"
password_pbkdf2 root grub.pbkdf2.sha512.10000.465B5EE2D2F6A767304EB397D6D97C70BC38653F95AFE58B24F190D5DABB0143920F736C125B91FB9F298AFF3D0F8FBBFB8228D5C8C9DD371ADBB1044CC80BFC.52D87AFD47A5BE2D7B6CF755D26CD5F481557DBCF5E725ABA44BF003A2970D3F775E8657428EDC201D86A3DF07D7A8109AFD5764EA058BE94D840F42ED17C3E2
### END /etc/grub.d/40_custom ###
...

References

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .