Years ago, I had a argument with quidam on this issue. He believed GRUB's
password had security to Trisquel. It turns out even GRUB developers (who
implemented the feature) disagree. They write in
https://www.gnu.org/software/grub/manual/grub.html#Security the following:
By default, the boot loader interface is accessible to anyone with physical
access to the console: anyone can select and edit any menu entry, and anyone
can get direct access to a GRUB shell prompt. For most systems, this is
reasonable since anyone with direct physical access has a variety of other
ways to gain full access, and requiring authentication at the boot loader
level would only serve to make it difficult to recover broken systems.
However, in some environments, such as kiosks, it may be appropriate to lock
down the boot loader to require authentication before performing certain
operations.
I do not think Trisquel's project mainly aim at kiosks...
Extra steps (which are not newbie-friendly at all) allow to remove GRUB's
password:
$ sudo rm /etc/grub.d/01_PASSWORD
$ sudo update-grub
To additionally want recovery entries for the GNU/Linux operating systems
also use that command before 'sudo update-grub':
$ sudo sed -i 's/GRUB_DISABLE_RECOVERY/#&/' /etc/default/grub
