GRUB2

Password protection of GRUB menu

grub-mkpasswd-pbkdf2 -c 100000

... generates pbkdf2 password hash with 100000 iterations

# Grub user
echo 'set superusers="<username>"'
# Grub password
echo 'password_pbkdf2 <username> <password-hash>'

... in /etc/grub.d/35_auth

N.B. menuentry using --unrestricted will be exempted

Config generation and grub-install

grub-mkconfig -o /boot/grub/grub.cfg

... Generate a GRUB2 config file placing it on /boot/grub/grub.cfg

grub-install /dev/sda

... installs GRUB2 on a dedicated GRUB boot partition for booting on a PC-BIOS machine.

grub-install --target=x86_64-efi --efi-directory=/boot/efi

... installs GRUB2 on EFI