2

I have an user account to log into grub, this works. Every time I boot the computer I am asked for my username and password to boot my operating system.

How can I set grub so it only requests the username and the password when I try to edit the boot loader? For example, when I normally start my computer I can get straight into the operating system, but if I want to edit the loader to gain superuser; Then I am requested the credentials.

1 Answer 1

3

To allow selecting a boot menu option (as-is, without editing it) without a username/password query when GRUB has password(s) configured, you'll need to add the --unrestricted option to its menuentry line in grub.cfg.

You probably already have set superusers="your_username" set in your grub.cfg.

Example from GRUB manual, with non-relevant parts elided:

set superusers="root"
password_pbkdf2 root grub.pbkdf2.sha512.10000.biglongstring
password user1 insecure

menuentry "May be run by any user" --unrestricted {
    ... existing menu entry contents here ...
}

menuentry "Superusers only" --users "" {
    ... existing menu entry contents here ...
}

menuentry "May be run by user1 or a superuser" --users user1 {
    ... existing menu entry contents here ...
}

Unfortunately, it looks like the simplified GRUB configuration (the /etc/default/grub file + the grub-mkconfig command) cannot do this for you directly. At minimum, you might need to edit the scripts in /etc/grub.d/ directory to add the --unrestricted option to the boot entries you wish to be available without entering a password.

3
  • I have a hard time finding what should I put in these "set root=" and "linux" fields for the menuentry blocks. I tried checking my /boot/grub/grub.cfg but I'm too blind to find anything useful there. Any tip?
    – Navarro
    Aug 5, 2019 at 6:20
  • In your existing menu entries, there should already be the equivalents of the set root= and linux lines, since they define which partition and kernel file you're about to boot. With modern GRUB, the set root= may actually be replaced by search ... --set=root ... lines, for detecting the filesystem by its ID rather than by hardware position. The point is just to describe how to add --unrestricted to the menuentry line (or --users ..., if you want a password-protected menu entry).
    – telcoM
    Aug 5, 2019 at 12:47
  • This works! Thanks a lot. I added the --unrestricted flag to the 10_linux file to automatically generate it for the menu entries in a similar way it was done here to limit access to certain users.
    – Navarro
    Aug 5, 2019 at 19:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .