GRUB Bootloader Security Audit with Python: Check Kernels, Boot Entries, and UEFI Status (Free CLI Tool)

The bootloader is the first software that runs on your system, and it is a critical security boundary. A misconfigured GRUB can allow unauthorized users to boot into single-user mode, modify kernel parameters, or even bypass authentication entirely. Regular bootloader auditing is an essential part of Linux security hygiene.

dargslan-grub-check is a free Python CLI tool that audits your GRUB bootloader configuration, checks installed kernels, verifies UEFI/Secure Boot status, and identifies security weaknesses.

Quick Start

pip install dargslan-grub-check

dargslan-grub report           # Full bootloader report
dargslan-grub entries          # Boot menu entries
dargslan-grub kernels          # Installed kernel versions
dargslan-grub defaults         # GRUB default settings
dargslan-grub mode             # UEFI/BIOS and Secure Boot status
dargslan-grub issues           # Security issues

What the Tool Checks

• GRUB password protection: Without a GRUB password, anyone with physical access can edit boot parameters and gain root access
• Installed kernels: Identifies old kernels that should be cleaned up and kernels missing their initrd
• Boot mode: UEFI vs BIOS legacy mode detection
• Secure Boot: Whether Secure Boot is enabled (prevents unauthorized kernel modifications)
• GRUB timeout: Long timeouts slow boot and provide time for unauthorized boot parameter editing
• Kernel parameters: Checks for verbose vs quiet boot and security-relevant parameters

Python API

from dargslan_grub_check import GrubCheck

gc = GrubCheck()
print(f"Boot mode: {gc.check_boot_mode()}")
print(f"Running kernel: {gc.get_running_kernel()}")

for kernel in gc.get_installed_kernels():
    status = "RUNNING" if kernel.get('running') else ""
    print(f"  {kernel['version']} ({kernel['size_mb']} MB) {status}")

for issue in gc.audit():
    print(f"[{issue['severity']}] {issue['message']}")

Securing Your Bootloader

1. Set a GRUB password to prevent unauthorized boot parameter editing
2. Enable Secure Boot on UEFI systems to prevent unsigned kernel loading
3. Reduce GRUB timeout to 0-1 seconds on headless servers
4. Remove old kernels regularly to reduce boot menu clutter and disk usage
5. Verify all kernels have matching initrd files

Conclusion

Bootloader security is often overlooked, but it is a critical part of your server hardening strategy. dargslan-grub-check automates the audit process and gives you clear, actionable findings.

For more security tools, visit dargslan.com and explore our cybersecurity eBooks.