CentOS 7+ 安全防护 grub 需要密码进入单用户模式

文章

林里克斯

实验平台：CentOS Linux release 7.6.1810 (Core)

1.添加一个密码

$ sudo grub2-setpassword 
Enter password: 
Confirm password: 
#会将密码的哈希值存到 /boot/grub2/user.cfg 下，user.cfg 文件为新增文件。用户默认为 root

2.修改 grub.cfg

$ sudo vim /boot/grub2/grub.cfg

### BEGIN /etc/grub.d/10_linux ###
menuentry 'CentOS Linux (3.10.0-957.el7.x86_64) 7 (Core)' --class centos --class gnu-linux --class gnu --class os --unrestricted $menuentry_id_option 'gnulinux-3
.10.0-957.el7.x86_64-advanced-6a4d2076-f34d-47e6-9026-505f05d0345c' {
# --unrestricted 删除
        load_video
        set gfxpayload=keep
        insmod gzio
        insmod part_msdos
        insmod xfs
        set root='hd0,msdos1'
        if [ x$feature_platform_search_hint = xy ]; then
          search --no-floppy --fs-uuid --set=root --hint-bios=hd0,msdos1 --hint-efi=hd0,msdos1 --hint-baremetal=ahci0,msdos1 --hint='hd0,msdos1'  
14f65369-a320-4d08-8af4-6ace66b734f4
        else
          search --no-floppy --fs-uuid --set=root 14f65369-a320-4d08-8af4-6ace66b734f4
        fi
        linux16 /vmlinuz-3.10.0-957.el7.x86_64 root=/dev/mapper/centos-root ro crashkernel=auto rd.lvm.lv=centos/root rhgb quiet LANG=en_US.UTF-8
        initrd16 /initramfs-3.10.0-957.el7.x86_64.img
}
menuentry 'CentOS Linux (0-rescue-55b1daab18e34b8988707b3cb3eba7df) 7 (Core)' --class centos --class gnu-linux --class gnu --class os --unrestricted $menuentry_i
d_option 'gnulinux-0-rescue-55b1daab18e34b8988707b3cb3eba7df-advanced-6a4d2076-f34d-47e6-9026-505f05d0345c' {
# --unrestricted 删除
        load_video
        insmod gzio
        insmod part_msdos
        insmod xfs
        set root='hd0,msdos1'
        if [ x$feature_platform_search_hint = xy ]; then
          search --no-floppy --fs-uuid --set=root --hint-bios=hd0,msdos1 --hint-efi=hd0,msdos1 --hint-baremetal=ahci0,msdos1 --hint='hd0,msdos1'  
14f65369-a320-4d08-8af4-6ace66b734f4
        else
          search --no-floppy --fs-uuid --set=root 14f65369-a320-4d08-8af4-6ace66b734f4
        fi
        linux16 /vmlinuz-0-rescue-55b1daab18e34b8988707b3cb3eba7df root=/dev/mapper/centos-root ro crashkernel=auto rd.lvm.lv=centos/root rhgb qui
et
        initrd16 /initramfs-0-rescue-55b1daab18e34b8988707b3cb3eba7df.img
}

### END /etc/grub.d/10_linux ###