Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
As you know, recovering the root password of CentOS is easy. You can enter 'E' in GRUB and try to remount. Is there a way to prevent any password recovery?
I want to limit all general ways of recovering the root password for those who have remote access to the server (GRUB). I need a remote solution as physical access can bypass all restricted methods
Preventing password recovery in CentOS through remounting in GRUB can be challenging, it requires modifying the bootloader configuration and implementing additional security measures.
It's difficult to completely eliminate all possible methods of password recovery.
Here some approaches:
The question you need to ask yourself is: user-friendliness/simplicity versus security.
Physical access can bypass all restricted methods
For me, physical access also means that someone steals the server, removes the hard drives, and reads them on their own computer.
If you want to prevent someone from resetting the password if they have physical access, you would need to encrypt your disks using dm-crypt/cryptsetup/LUKS.
However, if a remote user accesses your system, what does that have to do with GRUB? When it comes to remote access, the encryption of your disks using dm-crypt/cryptsetup/LUKS does not directly relate to GRUB.
GRUB (Grand Unified Bootloader) is responsible for the initial booting process of your system and loading the operating system. It is not directly involved in disk encryption.
To enhance security against physical access, you need to encrypt the hard drives. If you don't want to manually enter a password, the question is who and how the server will be restarted.
If a person is present on-site, you can also create a USB stick that acts as a kind of dongle, storing a key for LUKS. When the server starts, you insert the USB stick, and the server reads the key/password from the USB stick to decrypt the hard drives and boot the system.
If someone gains access to the USB stick, they will also have the key and password.
Remote Access Security
I need a remote solution..
Strengthen the security of remote access to your server. If you using secure protocols such as SSH with key-based authentication instead of passwords. Disable direct root login and create separate user accounts with limited privileges for remote access. Regularly update and patch your server's software to address any potential security vulnerabilities.
If your only wish is to prevent editing grub, you can protect grub with a password following the Authentication and authorisation in GRUB instructions.
Note that by default, it will also require the password for loading the OS after each reboot. You'll need to allow starting the OS but protect editing with password by adding the --unrestricted to each menuentry as demonstrated in the answer to GRUB menu edit protection only.
