grub.conf文件中的密码该如何写，都是做什么用的密码
本文导语: redhat linux enterprice e3版本的 /boot/grub/grub.conf中可以给开机时配两个密码，一个是在系统选择界面中按“p”，一个在启动前要求输入密码，两个密码都是做什么用的密码？该如何设置这两个密码？好像还要写一句“lo...
|
You may be interested in how to prevent ordinary users from doing whatever they like, if you share your computer with other people. So this chapter describes how to improve the security of GRUB.
One thing which could be a security hole is that the user can do too many things with GRUB, because GRUB allows one to modify its configuration and run arbitrary commands at run-time. For example, the user can even read /etc/passwd in the command-line interface by the command cat (see cat). So it is necessary to disable all the interactive operations.
Thus, GRUB provides a password feature, so that only administrators can start the interactive operations (i.e. editing menu entries and entering the command-line interface). To use this feature, you need to run the command password in your configuration file (see password), like this:
password --md5 PASSWORD
If this is specified, GRUB disallows any interactive control, until you press the key
and enter a correct password. The option --md5 tells GRUB that `PASSWORD' is in MD5 format. If it is omitted, GRUB assumes the `PASSWORD' is in clear text.
You can encrypt your password with the command md5crypt (see md5crypt). For example, run the grub shell (see Invoking the grub shell), and enter your password:
grub> md5crypt
Password: **********
Encrypted: $1$U$JK7xFegdxWH6VuppCUSIb.
Then, cut and paste the encrypted password to your configuration file.
Also, you can specify an optional argument to password. See this example:
password PASSWORD /boot/grub/menu-admin.lst
In this case, GRUB will load /boot/grub/menu-admin.lst as a configuration file when you enter the valid password.
Another thing which may be dangerous is that any user can choose any menu entry. Usually, this wouldn't be problematic, but you might want to permit only administrators to run some of your menu entries, such as an entry for booting an insecure OS like DOS.
GRUB provides the command lock (see lock). This command always fails until you enter the valid password, so you can use it, like this:
title Boot DOS
lock
rootnoverify (hd0,1)
makeactive
chainload +1
You should insert lock right after title, because any user can execute commands in an entry until GRUB encounters lock.
You can also use the command password instead of lock. In this case the boot process will ask for the password and stop if it was entered incorrectly. Since the password takes its own PASSWORD argument this is useful if you want different passwords for different entries.
您可能感兴趣的文章:
本站(WWW.)站内文章除注明原创外，均为转载、整理或搜集自网络。欢迎任何形式的转载，转载请注明出处。