3

Is it possible to unlock password protected grub loader remotely? For LUKS encrypted disk, I can unlock using dropbear-initramfs package installed in Debian in which dropbear will run a custom listening port so that I can use it to unlock LUKS encrypted disk remotely. I'm wondering, if there is any solutions for grub password protected bootloader?

2

2 Answers 2

Reset to default
1

I might be mistaken, but I'd assume adding network server abilities to GRUB2 is out of scope for the project. The idea why you'd want a password-protected GRUB is that you want to enforce that someone is sitting in front of the computer to type in that password!

As you noted, if you want encrypted disks, but network access, an initramfs that contains some sort of server is the way to go. To make sure a local user couldn't change the boot device, you'd use secureboot, so that the hardware doesn't load an unsigned bootloader to begin with, and then you'd lock down the bootloader to only boot your approved system.

I think if you want a password-protected boot on a modern system (read: last 10 years or so), then not relying on GRUB might be the winning move: chances are, you're asking this because you're in a corporate or server environment. Chances are that your computer comes with a BMC (board management controller) which you can use to shut down, boot, supervise… your computer, even if the operating system is not running. Typical feature of these is to select a booted system for the next UEFI boot, and then reboot the main CPU. That way, you can simply configure the thing to not boot by itself, and to require remote login or someone local with the password to change the next booted system.

7
  • Thanks.. I saw a downvoted for this answer and I upvoted it.
    – MaXi32
    Aug 24, 2021 at 16:37
  • Yeah but how would your bootloader check if the initramfs is tampered with?
    – Balázs Börcsök
    Apr 30, 2022 at 0:05
  • @BalázsBörcsök Secure Boot guarantees that the bootloader hasn't been tampered with. Bootloaders can (and do) check signatures on images. So, you have a chain of trust from the trusted platform module to the userland you start.
    – Marcus Müller
    Apr 30, 2022 at 10:27
  • @MarcusMüller so technically there is not reason to encrypt the /boot directory?
    – Balázs Börcsök
    Apr 30, 2022 at 15:34
  • Not from the things you describe, as far as I can see, no. You do have to make sure that you've actually enabled secureboot! But many linux distros can set up a system on a secureboot-protected computer, so that shouldn't be impossible.
    – Marcus Müller
    Apr 30, 2022 at 15:45
0

You could use TPM (if supported by the system) or IP KVM.

Check this question for more info: https://security.stackexchange.com/questions/11899/help-to-account-all-the-points-of-physical-access-to-a-rack-server-to-steal-soft

9
  • Hai, thanks for the answer, could you explain more, this is a remote VPS server
    – MaXi32
    Aug 23, 2021 at 19:42
  • KVM over IP allows to connect a virtual keyboard, mouse and monitor to a remote server and use them as if they are local to you. Some hosting providers have this feature, e.g. docs.hetzner.com/robot/dedicated-server/maintainance/… docs.ovh.com/us/en/vps/use-kvm-for-vps euserv.com/en/dedicated-server/features/kvm-over-ip.php coolhousing.net/en/how-to-use-kvm-over-ip
    – Artem S. Tashkinov
    Aug 24, 2021 at 10:35
  • I understand what are you trying to convey and I think that is not what I want, I don't want to manually enter username and password using keyboard manually even they are just virtual console. Most of the VPS servers do not provide API to control their virtual console remotely for security purpose ( I asked this question in linode support for like 10 times in a year and that is the same answer I got; impossible).
    – MaXi32
    Aug 24, 2021 at 10:58
  • The only thing I can control with linode console is through SSH push script (but you know, this only work when SSH is running and a linux is ready to accept incoming SSH port to execute bash command..) ... but we are in a bootloader screen with password. I don't think you can control that.. but there must be a way like using dropbear-initramfs.
    – MaXi32
    Aug 24, 2021 at 11:00
  • Are you trying to protect your data from your hosting provider? Without using TPM I cannot think of any solution for this issue. Let's say you want to retrieve a password from a remote system on boot. How will you make the connection secure when your provider has full access to your system RAM and at some point the password will be stored there in plain text unless you use the latest AMD/Intel CPUs which offer full transparent RAM encryption? And I've not heard of any providers which offer this feature.
    – Artem S. Tashkinov
    Aug 24, 2021 at 11:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .