These instructions are tested with Ubuntu desktop 12.04, but will probably be useful in other Linux distros with GRUB2 as well. The goal is to block everything except booting the default system. In paricular, it should not be possible for anyone to boot into recovery mode, since that will bypass normal login and give root access directly. Run grub-mkpasswd-pbkdf2 from a terminal and enter the desired password, copy the output. Edit /etc/grub.