On Fri, 3 Aug 2001, David Maxwell wrote:

> If you'd rather have a password instead of disabling the prompt, look at
>
> src/sys/lib/libsa/checkpasswd.c and modify:
> char bootpasswd[16] = {'\0'}; /* into data segment! */
> Then rebuild libsa and biosboot, and install your new bootblocks.

Actually, I don't think you want to change bootpasswd by hand - it's an
MD5 hash.  Besides, the normal boot blocks don't have the code to check
the boot password.

Instead, you have to rebuild biosboot.sym with BOOTPASSWD defined.  Go to
/sys/arch/i386/stand/biosboot, and uncomment the "CPPFLAGS+=-DBOOTPASSWD"
line.  Unfortunantly, it seems this makes the boot code too big (just
reboots the machine instead of actually booting).  I'm not sure exactly
what "too big" means but the extra code pushes the address space just past
64kB, so I expect there is a 64k limit there.  So to use boot passwords,
you'll have to make your bootcode a little smaller.  If you don't need it,
you can disable handling of compressed kernels by setting SA_USE_CREAD=no.
Can anyone provide any insight into where this size limitation is coming
from?

Once you've made the changes to the Makefile, to a "make dependall
install" (might need a make cleandir first).  Then use installboot with
the "-p" option to set a boot password (computes an md5 hash and stores it
in that bootpasswd variable).  Once you install those bootblocks, it
will require the password to get to the boot menu, but not to boot with
the default options.

Again, it might make sense to have a biosboot_password installed by
default also, I can certainly understand where a boot password would
be handy.

Rick