CentOS 7 set grub password and single user login example code

There are significant differences between centos7 and centos6 in the steps of setting the grub password. This is recorded for future reference.

The purpose of grub encryption: to prevent criminals from modifying the root password in single-user mode

You can use plain text or encrypted ciphertext to encrypt grub. It is recommended to use the encrypted ciphertext method. The operation steps of the two methods are similar. This article takes the encrypted ciphertext method as an example.

1. Set up grub encryption

1. Use the grub2-mkpasswd-pbkdf2 command to create a ciphertext (be sure to save and remember the password you set)

2. At the end of the /etc/grub.d/00_header file, add the following content (root is the user name used for single-user login, and the third line after root is the ciphertext obtained after encryption in the previous step. Note that there is a space between root and the ciphertext, not a line break)

cat <<EOF
set superusers='root'
password_pbkdf2 root grub.pbkdf2.sha512.10000.B157F42E96462AB239C03000F113D32EB18FD48073F1FC7D8F87A8F3B3F89F662424ECCAB901F3A812A997E547FD520F3E99D0E080F4FE8B05E019757E34F75B.29C83F87B4B6C086FC9A81E046CC3623CC5CF2F82128EDC3A0364894E429D4993B28563F82D71BF346188108CBD4341FC4A71B90E543581646B4E7EAE920C54A
E0F

3. Recompile and generate grub.cfg file

grub2-mkconfig -o /boot/grub2/grub.cfg

The setup is complete.

2. Restart and use single user login test

1. Reboot to enter gurb interface

2. Press e

3. At this time, we need to enter the username and password we set to enter grub (seeing this interface means that we have set grub encryption to take effect). After entering correctly, you will enter the following interface

4. Edit and modify two places: change ro to rw, and add init=/bin/sh at the end of the line

5.ctrl+x starts single-user mode and enters the system

6. Change the root password

7. If selinux is turned on, you need to execute the following command to update the system information, otherwise the password will not take effect after restarting

touch /.autorelabel

8. Restart the system

exec /sbin/init

Login successfully using the modified root password.

The above is the full content of this article. I hope it will be helpful for everyone’s study. I also hope that everyone will support 123WORDPRESS.COM.