3

I am currently dual-booting one of my laptops, but I want the Linux distro to be practically hidden completely. So far I have been able to make it so then you have to press Shift for the grub menu to show up, and I have encrypted my Linux root partition (I do not have a home partition). I've heard that you can assign a password to a specific operating system, but I'm a little bit confused about how to do it.

Can I make it so that Windows does not require logging in?

How do I make it so that only my Linux OS is password protected?

(Note: I am using Windows 10 with Zorin OS 15 Core)

Edit: I am not talking about the windows login, I'm meaning, can I have it so then grub doesn't require me to log in to access windows (in the grub menu), but I still need to login into grub to access Zorin. Also, the people I'm trying to prevent from getting into my Zorin root partition aren't particularly smart so I don't really care if they could just use a live USB or something to get into it.

1
2

Setting up a supervisor user and password will restrict any other user from using menu entries, editing menu entries and from using the grub console. Adding --unrestricted to a menuentry allows any user to use that menu entry without entering username / password and adding --users with a list of user names allows additional users to access a menuentry.

For a minimal setup you need to add a superuser with password and add --unrestricted to the menuentry in /etc/grub.d/30_os_prober that generates your Windows menu entries.

  1. Edit /etc/grub.d/30_os-prober, find the menuentry responsible for the Windows entries and add --unrestricted to this menuentry. In my case I searched for the string Windows and edited the next menuentry line. The edited block now looks like this:

          cat << EOF
    menuentry '$(echo "${LONGNAME} $onstr" | grub_quote)' --unrestricted $CLASS --class os \$menuentry_id_option 'osprober-chain-$(grub_get_device_id "${DEVICE}")' {
    EOF
    
  2. Add your passwords to the end of /etc/grub.d/30_os-prober:

    cat << EOF
    set superusers="freddy"
    password freddy 1234
    EOF
    

    Note that it doesn't matter which config file in /etc/grub.d/ we use for our passwords. We could also use 00_header or 10_linux instead.

    If you want to encrypt your password, run grub-mkpasswd-pbkdf2, enter your password twice and use the generated string grub.pbkdf2.sha512.10000.<a_very_long_string> as your password. The password entry must then begin with password_pbkdf2 instead of password:

    password_pbkdf2 freddy grub.pbkdf2.sha512.10000.68B90AFC[...]86858AF939
    
  3. Run

    sudo update-grub
    

    to update grub and check if your generated Windows entry in /boot/grub/grub.cfg has the --restricted flag. The generated 30_os-prober-block should look similar to this:

    ### BEGIN /etc/grub.d/30_os-prober ###
    menuentry 'Windows 10 (on /dev/sda1)' --unrestricted --class windows --class os $menuentry_id_option 'osprober-chain-A25E43975E436361' {
        insmod part_msdos
        insmod ntfs
        set root='hd0,msdos1'
        if [ x$feature_platform_search_hint = xy ]; then
          search --no-floppy --fs-uuid --set=root --hint-bios=hd0,msdos1 --hint-efi=hd0,msdos1 --hint-baremetal=ahci0,msdos1  A25E43975E436361
        else
          search --no-floppy --fs-uuid --set=root A25E43975E436361
        fi
        parttool ${root} hidden-
        drivemap -s (hd0) ${root}
        chainloader +1
    }
    set superusers="freddy"
    password freddy 1234
    ### END /etc/grub.d/30_os-prober ###
    
  4. Reboot and test.

Related links:

1
  • Thank you for clarifying! – LiamBogur Dec 8 '19 at 20:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.