GRUB bootloader do not have password authentication

[Egor Kotko]

Set a password on GRUB bootloader to prevent altering boot configuration

Steps to reproduce:
1. Reboot master node
2. Enter into edit mode of GRUB entries (press e into menu http://snag.gy/EsjwX.jpg)

Expected result: the entrance should be protected by password auth
Actual result: user get access without auth http://snag.gy/vvdSB.jpg

[Maksim Malchuk (mmalchuk)]

Which password should be used for this? Where can it be managed? in the web? in the fuel-menu? or it should be 'standard' one and hardcoded?
A solution may be very complicated because need changes in the separate projects like fuel-web, fuel-agent, fuel-menu and fuel-library.

[Egor Kotko (ykotko)]

The most appropriate password will be the standard in such case.
Seems fuel menu will be normal place for management this pass

[Alexander Gordeev (a-gordeev)]

If a one has any physical/IPMI access to a node, then the one can do whatever he/she wanted with the bootloader if BIOS/UEFI setup isn't protected by password too.

protecting grub with the password is a kind of non-sense for such case, the one could load any other bootloader/OS with ease.

therefore, without more low-level protection in advance, this grub password is next to useless.

[Maksim Malchuk (mmalchuk)]

Agree with Alexander, so this will confirm that this is not a bug but wishlist.

[Egor Kotko (ykotko)]

My point is that we should give to user base security level, if user will add password on bios/uefi, will he open ports in nwfilter after deployment, it is all his responsibility.

[Maksim Malchuk (mmalchuk)]

Nastya why did You raised the importance without an explanation?

[Bug Checker Bot (bug-checker)]

(This check performed automatically)
Please, make sure that bug description contains the following sections filled in with the appropriate data related to the bug you are describing:

version

For more detailed information on the contents of each of the listed sections see https://wiki.openstack.org/wiki/Fuel/How_to_contribute#Here_is_how_you_file_a_bug

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/358143

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/358143
Committed: https://git.openstack.org/cgit/openstack/fuel-menu/commit/?id=1da4d4f45c22423c8e2099d112fe1473560b0c5f
Submitter: Jenkins
Branch: master

commit 1da4d4f45c22423c8e2099d112fe1473560b0c5f
Author: Maksim Malchuk <email address hidden>
Date: Sat Aug 20 02:33:02 2016 +0300

    Add GrubPassword module to the fuelmenu

    This change adds new GrubPassword module to the fuelmenu which can
    configure password for the editing grub menu. The module creates the
    default /boot/grub2/user.cfg file with hashed password only when it
    entered interactively. For security reasons the plain password never
    stored and the file always overwritten with new one provided.

    DocImpact
    Closes-Bug: #1552164
    Change-Id: I3bc330133dd3d71ea62a7169a84d9ad802a4a3ef
    Signed-off-by: Maksim Malchuk <email address hidden>

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/fuel-menu 10.0.0rc1 release candidate.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/fuel-menu 10.0.0 release.