Hello everyone and welcome to this lesson.
So in the previous lesson, we saw
that how we can reset the root password or
any other uses password directly from
the grub menu.
Now you may be thinking that if someone has a
physical access to your computer or your device, they
could possibly reset your password and
get into your computer.
And you must be thinking they should be an additional layer
of security that he or she
or maybe any attacker.
Or a third party person should not be able
to access the grub menu and
modify those entries.
So for that, we have a solution we can basically put
a password or lock our grub itself.
So in this lesson, you're going to see how you can
keep an additional layer of security by making
a password for the grub, which
is basically protecting it so it will
be a two-factor authentication for you. That is
whenever you need to start your computer.
You need to give the authentication that
is the correct username and password for the grub. And
then the final login screen, which is
the user login that is root and the password. So let's
see this how to set up a grub
based authentication mechanism.
So first, I'm going to open up my terminal as
you can see over here and in the
terminal first, let's verify which
is the user currently logged in so I am root.
These are the steps to set up the grub password.
The first step is to generate encrypted hash
value. So for
that the command is grub make password
in the format, which is pbkdf2.
Now if you're not aware about what what is pbk df2
then it is basically a
hashing algorithm.
So it applies a pseudo random function
such as a hash based message authentication
code, which is hmac to the
input password or passphrase that we are going to
provide there is let's say my password is going
to be root.
With assault value which is random and repeats
the process many times to produce a
derived key, which is basically secure.
Now it utilizes that specific key
for further subsequent operations or
other actions wherein it needs to
provide the authentication. So, let's
see this how it actually works.
So I need to type this command and hit enter
now. This is asking for the password or
passphrase that you need to provide.
As you can see over here. I have provided my password as
root and it has generated successfully a
hash of my password as can
be seen onto the screen.
Alright, so we have successfully generated the hash
for my password using the cryptographic algorithm,
which is PB kdf2.
Quickly, let's open up a new terminal window.
And now in the new terminal window what we are
going to do is we are going to modify a file which
is 40 custom.
What is the reason to modify this file? You will come to
know in just few seconds. So let's first go into the
directory of grub, which is under the
EDC home directory.
Once we are over here.
We will quickly create a backup file of this
40 underscore custom file in case
anything goes wrong. We can roll back
all our changes.
Now once you are into this file, you need
to modify this so you can use Nano or
Vim. I'm using currently Nano.
This is basically the configuration file which is
required to give instructions that
we need to set up a username password into
our grub.
You already generated a hash and we will now
use that hash as password while we
log in into the machine at the grub screen
so you can specify the name of
the user over here. So I'm specifying the
root user because I want to authenticate as the
root user.
So set super users as root and the password.
So password underscore pbkdf to
the username once more that is root and
the hash here. This is basically the hash
that we have generated in the previous step, which
is this you need to keep in mind that you
need to copy the hash from
Your password is after that string
complete and Grub dot start.
You need to copy that which is highlighted currently onto
the left terminal.
So I'll just copy this quickly and you
need to paste it over here. I already have
a older hash which I will remove
and I'll replace it with the new hash that
we have generated recently.
So we have successfully deleted the old hash and
replaced it with a new hash value looks perfect.
Now we are going to save this file.
This hash and the new hash is
exactly the same. So we need to save that file.
So we'll quickly just say control s
and will come out of the file.
The next step is to make config. So
we are going to give this command which is grub make
config hyphen o the configuration file
of grub.
By doing this command grub will automatically verify
that whatever changes that we have done in
the configuration file are correct or no?
It will also try to load the new changes
that we have created in the 40
underscore custom file.
You can see it verified. Everything was correct. So now
we are going to do a restart onto the computer. So we
have used the command that is in at 6.
You can see the computer is going to boot in four seconds
as can be seen over here and it will present us a
grub menu.
Now previously, it used to just load
the grub menu and start the
Kali Linux machine where it would ask
the username and password.
But now here you can see it is asking a username
and password at the grub screen itself. Now
we need to give the correct username and
password to the grub screen to verify that.
Yes, we have the access to modify
changes into this machine or the grub
entry as well.
Once we verify this correctly this computer will
now start and will present
a new login screen for us, which is basically
the user login to which we
want to login.
So I have provided the correct username and
password for the grub menu, which was root and
root and hit enter.
Now you can see the famous Kali theme
logo has successfully loaded and here
I need to login.
So I will use my username password which is root and
ABCD and hit enter.
You can successfully verify I have successfully logged in into
my computer. So this is it for this lesson. I hope
you guys understood how you can configure a grab
password for your computer. Thank you.