I recently forgot my password, and then used this single-user mode to reset the password. I feel very scared. No matter how complicated the password, just enter this mode after restarting and it can be broken. So it is necessary to block this loophole.

# Modify startup file

You can modify /boot/grub/grub.cfg directly, of course it is best to change /etc/grub.d/00_head (security) and add at the end:

cat << EOF
set superusers="user1"
password user1 PasswordOfUser1
EOF

In this case, the grub-mkconfig configuration file generated by grub will automatically include the power-on password, instead of having to modify the grub.cfg file each time. Note: If you set the password in plain text, make sure that the /etc/grub.d/00_head file and the /boot/grub/grub.cfg file have no rw permissions except for root. After version 1.98, GRUB2 can set an encrypted password. First use grub-mkpasswd-pbkdf2 to generate an encrypted password (an encryption tool based on the pbkdfv2 algorithm). Then, append to the end of /etc/grub.d/00_head:

cat << EOF
set superusers="user1"
password_pbkdf2 user1 EncryptedPasswordOfUser1
EOF

# to validate

Use the update-grub command to make the changes take effect, restart the machine, enter "e" in the grub boot menu, you need to enter the username and password to enter. This setting is mainly to prevent others from modifying your root password by rebooting.