Setting a GRUB password

You can set up a password to prevent unauthorized users from accessing the GRUB command line, modifying kernel command-line arguments, or booting non-default OSTree deployments.

Creating the password hash

You can use grub2-mkpasswd-pbkdf2 to create a password hash for GRUB.

$ grub2-mkpasswd-pbkdf2
Enter password: <PASSWORD>
Reenter password: <PASSWORD>
PBKDF2 hash of your password is grub.pbkdf2.sha512.10000.5AE6255...

grub2-mkpasswd-pbkdf2 tool is a component of the grub2-tools-minimal package on Fedora.

Butane config

With the password hash ready, you can now create the Butane config.

variant: fcos
version: 1.6.0
grub:
  users:
    - name: root
      password_hash: grub.pbkdf2.sha512.10000.5AE6255...

The Butane config defines a GRUB superuser root and sets the password for that user using a hash.

You can now use this config to boot a Fedora CoreOS instance.

Want to help? Learn how to contribute to Fedora Docs ›