RHEL / CentOS 7: Single user boot and grub locking

While working on Linux Operating system, one definitely came across a stage, where we have to perform some troubleshooting, which is not possible without Single user mode (ex: Resetting forgotten root password, fixing filesystem issues etc).

Single user mode (aka Maintenance Mode) is a mode in which a multi-user computer operating system boots into a single superuser. It is mainly used for maintenance of multi-user environments such as network servers. Some tasks may require exclusive access to shared resources.

It is runlevel 1 under system SysV init, and runlevel1.target or rescue.target in systemd.

BOOTING SYSTEM IN SINGLE USER MODE

1) Boot(Restart) your system and wait until the GRUB2 menu appears.

2) In the boot loader menu, select your kernel version entry and press e to edit.

3) Find the line beginning with linux16. At the end of this line, append the following: replace “ro” with “rw init-/sysroot/bin/sh”.

Before conversion

After conversion

Press F10 or Ctrl+X to boot the system using the options you just edited (access an emergency shell).

4) Once the system boots, you will be presented with a shell prompt without having to enter any user name or password:

Mount root filesystem temporarily

Perform tasks as per the requirements (as we are changing root password here)

5) Once you are done with changes, instruct SELinux to relabel all files upon reboot (because the /etc/shadow file was changed outside of its regular SELinux context) — run:

SETTING PASSWORD ON EDITING KERNEL ENTRY

Password is required for modifying menu entries but not for booting existing menu entries:

1) Run the grub2-setpassword command as root:

[root@linux01 ~]# grub2-setpassword
Enter password: redhat
Confirm password: redhat
[root@linux01 ~]#

2) Following this procedure creates a /boot/grub2/user.cfg file that contains the hash of the password.

[root@linux01 ~]# cat /boot/grub2/user.cfg
GRUB2_PASSWORD=grub.pbkdf2.sha512.10000.51E60744B2E6EE55687FFE5D0C495961E39840FE8B66F1BDBE38B69CA64B02D66071DC7FF6F69340721C6B49F62B02156DD1223F07C01B7AEAF5CB1DA7DA81CD.BB2CAE35A896A606816318705B6BEEB2D874ACAFF53ECA98E306A2E8FDF694C96BC56572B44CC01B828ED181B05C4468A25A72B9A1B3398A6D9B4A8BEE20F103
[root@linux01 ~]#

3) The user for this password, root, is defined in the /boot/grub2/grub.cfg file. With this change, modifying a boot entry during booting requires you to specify the root user name and your password.

SETTING PASSWORD TO SECURE GRUB ITSELF (RHEL7.2 or above)

Setting a password using the grub2-setpassword prevents menu entries from unauthorized modification but not from unauthorized booting. To also require password for booting an entry, follow these steps after setting the password with grub2-setpassword:

1) Open the /boot/grub2/grub.cfg file.

2) Find the boot entry that you want to protect with password by searching for lines beginning with menuentry.

[root@linux01 ~]# cat /boot/grub2/grub.cfg | grep -i unrestricted
menuentry ‘CentOS Linux (3.10.0-862.el7.x86_64) 7 (Core)’ –class centos –class gnu-linux –class gnu –class os –unrestricted $menuentry_id_option ‘gnulinux-3.10.0-862.el7.x86_64-advanced-00d34b55-6ba1-4e12-b74b-aa5a4b43c4ea’ {
menuentry ‘CentOS Linux (0-rescue-f03a6aac8b3c4af597a814be07e1d331) 7 (Core)’ –class centos –class gnu-linux –class gnu –class os –unrestricted $menuentry_id_option ‘gnulinux-0-rescue-f03a6aac8b3c4af597a814be07e1d331-advanced-00d34b55-6ba1-4e12-b74b-aa5a4b43c4ea’ {

3) Delete the –unrestricted parameter from the menu entry block, save and close the file

[root@linux01 ~]# vi /boot/grub2/grub.cfg
[root@linux01 ~]# cat /boot/grub2/grub.cfg | grep -i unrestricted
menuentry ‘CentOS Linux (0-rescue-f03a6aac8b3c4af597a814be07e1d331) 7 (Core)’ –class centos –class gnu-linux –class gnu –class os –unrestricted $menuentry_id_option ‘gnulinux-0-rescue-f03a6aac8b3c4af597a814be07e1d331-advanced-00d34b55-6ba1-4e12-b74b-aa5a4b43c4ea’ {
[root@linux01 ~]#

NOTE:If you delete the –unrestricted parameter from every menu entry in the /boot/grub2/grub.cfg file, all newly installed kernels will have menu entry created without –unrestricted and hence automatically inherit the password protection.

Note: Manual changes to the /boot/grub2/grub.cfg persist when new kernel versions are installed, but are lost when re-generating grub.cfg using the grub2-mkconfig command. Therefore, to retain password protection, use the above procedure after every use of grub2-mkconfig.