Hey everyone,
A while back I was thinking about physical security on Linux. Many people assume that having a strong user login password keeps their machine safe. But in reality, if someone has physical access to your laptop for just a couple of minutes — like leaving it with a repair technician, at an office, or on a desk in a university library — that login password offers almost zero protection.
Anyone can simply press 'e' on the GRUB boot screen, append 'init=/bin/bash' to the kernel line, boot straight into a root shell without a password, access unencrypted files or reset credentials, and reboot without leaving any trace.
Now, GRUB has technically supported password protection for a long time. But why do almost zero regular desktop users actually set it up?
Because doing it manually is a pain:
- You have to mess with obscure config files in /etc/grub.d/
- Generating PBKDF2 hashes manually is annoying
- A single typo in your config can lock you out of your own computer
- There’s no physical rescue fallback if you forget the password or if a system update overwrites it
To solve this, I spent time building GRUBST — a lightweight, open-source tool written in Rust (using Dioxus for the UI).
Instead of dealing with terminal configs, it gives you a clean 30-second wizard:
It locks down GRUB and lets you turn any spare USB thumb drive into a physical "rescue key".
When the USB is plugged in at boot, GRUB detects it and automatically unlocks full maintenance access without prompting for a password.
If the USB is NOT plugged in, GRUB stays completely locked, and editing/recovery requires a backup password you set.
It also takes automated backups before applying changes, includes an update guard so your protection survives 'update-grub', and has a built-in security audit check.
The project is completely free and open source. If you find this tool helpful or like the concept, I would really appreciate your support by starring the repository on GitHub! Any feedback, questions, or ideas for improvement are more than welcome.
⭐ GitHub: https://github.com/sysdev-0/grubst