Linux security settings about Grub Encryption Text Tutorial full solution _linux

The so-called grub is the configuration of the/boot/grub/grub.conf file.

Let's talk about the benefits of grub encryption.

1, can let the person who does not know the password cannot start the system.

2, can prevent others to modify the startup parameters.

######################################################################

Grub encryption is divided into two types.

1, Global encryption

2, local encryption

Global cryptography:

Function: Lock the boot interface and prohibit

E to edit the commands before booting

A to modify the kernel arguments before booting

C for a command-line

　　

The main function of this global encryption is to edit the commands, because this will see the local password.

　　

Then we look at the global password-adding effect. He needs you. Press P to enter the global password before you can edit and view the commands. This will protect our local passwords. Do not enter a global password can be entered directly to start the system, if you still have local password, you need to enter a local password.

　　

Local cryptography: Control relative to a particular hyper-system.

Function: The user must enter a password to enter the system.

　　

。

Let's look at how to implement these functions.

###################################################################

Select Local encryption:

Since each system is marked by title, our local encryption is added after this flag

The corresponding statement.

Encryption is divided into two types

1. Clear text

2, MD5 encryption.

The concrete method is as follows figure

　　

How is that MD5 encryption generated? You can use the command below.

　　

　　

In the picture I mark is the password which you enter, MD5 the value, directly copies the/boot/grub.grub.conf to be possible. Then save the launch, the new start will require you to enter the password to enter the system. But we can see the password in the Start screen by using the E key to edit into command mode. What do we need to do to prevent this from happening? It requires global encryption and does not allow others to have edit permissions.

Global cryptography:

As Mr. MD5 a password. And then into/boot/grub/grub.conf.

In front of the first title tag, such as our password, as shown in the figure, after TIMEOUT5 is our global encryption.

　　

The other person needs a global password to view the local password.

Grub encryption is basically the case, the specific situation requires your own flexibility to use.