Hier werden die Unterschiede zwischen zwei Versionen gezeigt.
lpi1:bootloader [2019/10/31 09:59] 127.0.0.1 Externe Bearbeitung |
lpi1:bootloader [2024/04/17 12:37] |
||
---|---|---|---|
Zeile 1: | Zeile 1: | ||
- | ====== Bootloader ====== | ||
- | ===== Bootloader löschen ===== | ||
- | dd if=/dev/zero of=/dev/sda bs=$((512-64)) count=1 | ||
- | |||
- | ===== grub2 ===== | ||
- | ==== Grub2 in den MBR installieren ==== | ||
- | === CentOS 7 === | ||
- | yum install grub2 | ||
- | |||
- | === Debian (ab 6.0) Ubuntu (ab 14.04) === | ||
- | apt-get install grub-pc | ||
- | update-grub2 | ||
- | grub-install /dev/sda | ||
- | |||
- | === openSuSE 12.2 === | ||
- | update-bootloader | ||
- | grub2-install /dev/sda | ||
- | |||
- | ==== Kernel Bootparameter ändern ==== | ||
- | Z.B. Kernel Argument ''nomodeset'' setzen: | ||
- | === openSuSE 12.3 === | ||
- | ''/etc/default/grub'' : | ||
- | |||
- | Zeile ''GRUB_CMDLINE_LINUX_DEFAULT'' anpassen | ||
- | |||
- | ''/boot/grub2/grub.cfg'' neu erstellen: | ||
- | grub2-mkconfig --output=/boot/grub2/grub.cfg | ||
- | |||
- | === debian (ab 6.0) ubuntu (14.04) === | ||
- | ''/etc/default/grub'' : | ||
- | |||
- | Zeile ''GRUB_CMDLINE_LINUX_DEFAULT'' anpassen | ||
- | |||
- | ''/boot/grub/grub.cfg'' neu erstellen: | ||
- | grub-mkconfig --output=/boot/grub/grub.cfg | ||
- | |||
- | === centos (ab 7) === | ||
- | siehe [[#grubby]] | ||
- | ==== Grub2 mit Passwort absichern ==== | ||
- | === Root Passwort ändern === | ||
- | Grub Bootprompt: ''init=/bin/bash'' als Parameter zum Linux Kernel hinzufügen | ||
- | |||
- | Kernel mit ''strg+x'' booten | ||
- | |||
- | mount -o remount,rw / | ||
- | passwd | ||
- | |||
- | touch /.autorelabel | ||
- | |||
- | ((nur bei Systemen mit aktiviertem SELinux notwendig)) | ||
- | |||
- | mount -o remount,ro / | ||
- | exec /sbin/init | ||
- | |||
- | === Grub absichern === | ||
- | == Passwort Hash erzeugen == | ||
- | Debian 6, CentOS 7: | ||
- | grub2-mkpasswd-pbkdf2 | ||
- | |||
- | Debian (ab 7), Ubuntu (ab 14.04): | ||
- | grub-mkpasswd-pbkdf2 | ||
- | |||
- | == Passwort Hash eintragen == | ||
- | <file txt /etc/grub.d/45_password> | ||
- | #!/bin/sh | ||
- | exec tail -n +3 $0 | ||
- | # This file provides an easy way to add custom menu entries. Simply type the | ||
- | # menu entries you want to add after this comment. Be careful not to change | ||
- | # the 'exec tail' line above. | ||
- | set superusers="root" | ||
- | password_pbkdf2 root grub.pbkdf2.sha512.10000.FF73A777C6793E117430446F4D12F00D25DA53515B5048B1DAAA0688743550226CD05AD661EBDCA2AA1997AEBDC0C35C74CA48C9309FBED1C201C5875E3AD2E8.292A1642CB109860054562756A5AE950975B586A8DFDE535F566D1ADDCC6747349406E84862FFD9258F64268A36E63EF25A41A3CC0CD6291E63D98CEDDF00FE6 | ||
- | </file> | ||
- | |||
- | chmod +x /etc/grub.d/45_password | ||
- | |||
- | == grub Konfigurationsdatei neu erzeugen == | ||
- | Debian (ab 6), Ubuntu (14.04): | ||
- | grub-mkconfig -o /boot/grub/grub.cfg | ||
- | |||
- | CentOS (7): | ||
- | grub2-mkconfig -o /boot/grub2/grub.cfg | ||
- | |||
- | == Auswahl ermöglichen, editieren absichern == | ||
- | <file txt /etc/grub.d/10_linux> | ||
- | ... | ||
- | CLASS="--class gnu-linux --class gnu --class os --unrestricted" | ||
- | ... | ||
- | </file> | ||
- | |||
- | == testen == | ||
- | Debian (ab 6), Ubuntu (14.04): | ||
- | grep password /boot/grub/grub.cfg | ||
- | reboot | ||
- | CentOS (7): | ||
- | grep password /boot/grub2/grub.cfg | ||
- | reboot | ||
- | |||
- | === Doku === | ||
- | * https://www.gnu.org/software/grub/manual/html_node/Security.html | ||
- | |||
- | ===== grubby ===== | ||
- | Anzeigen der Konfiguration des Bootmanagers | ||
- | grubby --info=ALL | ||
- | |||
- | Eine Option zum Default-Kernel hinzufügen (hier: SELinux ausschalten) | ||
- | grubby --args="enforcing=0" --update-kernel="$(grubby --default-kernel)" | ||
- | |||
- | Optionen vom Default-Kernel entfernen (hier: Unterdrückung der Kernel-Meldungen ausschalten) | ||
- | grubby --remove-args="rhgb quiet" --update-kernel="$(grubby --default-kernel)" | ||
- | |||
- | ===== grub ===== | ||
- | ==== Grub in den MBR installieren ==== | ||
- | === Debian === | ||
- | grub-install /dev/sda | ||
- | oder | ||
- | grub | ||
- | device (hd0) /dev/sda | ||
- | root (hd0,0) | ||
- | setup (hd0) | ||
- | quit | ||
- | |||
- | update-grub | ||
- | |||
- | === SuSE === | ||
- | grub-install /dev/sda | ||
- | oder | ||
- | grub | ||
- | device (hd0) /dev/sda | ||
- | root (hd0,0) | ||
- | setup (hd0) | ||
- | quit | ||
- | |||
- | ==== Neuen Kernel testen ==== | ||
- | System rebooten, und einmalig den 3. Eintrag ( grub fängt bei 0 an zu zählen ... ) aus ''/boot/grub/menu.lst'' verwenden: | ||
- | |||
- | SuSE: | ||
- | grubonce 2 | ||
- | |||
- | Debian: | ||
- | grub-reboot 2 | ||
- | |||
- | ==== Grub mit Passwort absichern ==== | ||
- | === Root Passwort ändern === | ||
- | Grub Bootprompt: ''init=/bin/bash'' hinzufügen | ||
- | |||
- | Kernel mit ''b'' booten | ||
- | |||
- | mount -o remount,rw / | ||
- | passwd | ||
- | mount -o remount,ro / | ||
- | exec /sbin/init | ||
- | |||
- | === Grub absichern === | ||
- | /sbin/grub-md5-crypt | ||
- | |||
- | ''/boot/grub/menu.lst'' : | ||
- | <file> | ||
- | password --md5 $1$ZkniA/$2EBU5eSONAj.i2KIhhtWA0 | ||
- | </file> | ||
- | |||
- | ===== Dokus & Links ===== | ||
- | * http://wiki.ubuntuusers.de/grub_2/konfiguration | ||