Information
If the system does not require valid root authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. GRUB 2 is the default boot loader for RHEL 7 and is designed to require a password to boot into single-user mode or make modifications to the boot menu.
Solution
Configure the system to encrypt the boot password for root.
Generate an encrypted grub2 password for root with the following command:
Note: The hash generated is an example.
# grub2-mkpasswd-pbkdf2
Enter Password:
Reenter Password:
PBKDF2 hash of your password is grub.pbkdf2.sha512.10000.F3A7CFAA5A51EED123BE8238C23B25B2A6909AFC9812F0D45
Edit '/etc/grub.d/40_custom' and add the following lines below the comments:
# vi /etc/grub.d/40_custom
set superusers='root'
password_pbkdf2 root {hash from grub2-mkpasswd-pbkdf2 command}
Generate a new 'grub.conf' file with the new password with the following commands:
# grub2-mkconfig --output=/tmp/grub2.cfg
# mv /tmp/grub2.cfg /boot/efi/EFI/fedora/grub.cfg