Boot process and recovery: GRUB, systemd
Boot loader, kernel, initramfs and rescuing a system that won’t boot.
Level 301 · 18 lessons · 15 practice labs
Lessons
The boot chain
- The boot process: from firmware to login: You will understand the order a computer follows at startup, from firmware to bootloader, kernel and the login screen.
- An introduction to UEFI, BIOS and Secure Boot
- The GRUB menu and kernel parameters: You will learn how the GRUB boot menu works, what kernel parameters do, and what to be careful about when changing the menu.
- initramfs: looking inside and rebuilding it
- systemd targets and runlevels: You will learn how systemd targets replaced the old runlevels, and how to start a system without a graphical interface or in maintenance mode.
- Measuring boot time: systemd-analyze: You will use systemd-analyze to measure where startup slows down, and speed it up by finding unneeded services.
- Short task: find the service that delays boot by a minute
Kernel and hardware
- Kernel messages: dmesg: You will use dmesg to read the messages the kernel gives at boot and while running, and find the first traces of hardware and driver problems.
- Kernel modules: You will learn what kernel modules are, how to list the loaded ones, and why disabling the unneeded ones helps hardening.
- Inspecting hardware: lscpu, lspci, lsusb and dmidecode: With lscpu, lspci, lsusb and dmidecode you can list a server’s CPU, cards and USB devices and notice unexpected hardware.
- Short task: blacklist a troublesome module
Recovery
- Safe shutdown and reboot: You will learn to shut down and restart a server without losing data, schedule a shutdown, and warn users in advance.
- Rescue mode: You will learn to boot a system that will not start normally into rescue mode, check its file system, and fix a broken setting.
- Safely resetting a forgotten root password
- A system that won't boot because of a bad fstab line
- Booting an older kernel and changing the default
- Reinstalling GRUB from a rescue environment
- Capstone: recover a server that will not boot: A fictional company's lab server will not boot; you read the symptoms, find the cause using rescue mode, bring the server back, and document your steps.
Practice labs
- Determine at which stage boot stopped: Study three console outputs and write for each whether boot stopped at firmware, boot loader, kernel or systemd.
- Pass a one-off kernel parameter in GRUB: Boot the server into the rescue target with a temporary parameter from the GRUB menu and show the change is not permanent.
- Rebuild an initramfs missing a driver: On a system that cannot find its root disk, inspect the initramfs contents, add the missing module and rebuild it.
- Find the unit that delays boot the most: Measure boot time with systemd-analyze and submit the name of the slowest unit.
- Fix a wrong default target: Change the default target of a server that hangs trying to reach the graphical target to the multi-user target.
- Untangle a one-minute boot delay: From the critical chain find the wait unit behind the delay, remove the needless dependency and measure the new time.
- Find a hardware error in kernel messages: Filter dmesg output by severity and submit the name of the device reporting errors.
- Blacklist a troublesome module: Permanently prevent a module that errors at boot from loading and verify it stays unloaded after a reboot.
- Inventory hardware and verify driver matches: List CPU, memory, PCI and USB devices, find the device with no driver loaded and determine which module it needs.
- Reset a forgotten root password on your own lab server: With console access boot the server into a rescue shell, reset the password and confirm SELinux labels are corrected.
- Fix a bad fstab from emergency mode: On a server dropped to emergency mode remount root writable, fix the faulty line and get a normal boot.
- Repair a broken boot loader from a rescue environment: Open a system with a wiped boot loader through chroot in a rescue environment, reinstall GRUB and regenerate its config.
- Set the default kernel and timeout: Set the GRUB default entry to the previous kernel, the timeout to five seconds and confirm it persists.
- Protect GRUB editing with a password: Require a password to edit boot entries while showing a normal boot still proceeds without one.
- Audit the security state of the boot chain: Check Secure Boot state, unsigned modules, GRUB protection and the rescue shell's password requirement and write a findings report.
About this course
Boot loader, kernel, initramfs and rescuing a system that won’t boot.
What you will learn
- The boot chain
- Kernel and hardware
- Recovery
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.