SUSE operating systems with Unified Extensible Firmware Interface (UEFI) implemented must require authentication upon booting into single-user mode and maintenance.

From SLES 12 Security Technical Implementation Guide

Part of SRG-OS-000080-GPOS-00048

Associated with: CCI-000213

SV-91841r3_rule SUSE operating systems with Unified Extensible Firmware Interface (UEFI) implemented must require authentication upon booting into single-user mode and maintenance.

Vulnerability discussion

If the system allows a user to boot into single-user or maintenance mode without authentication, any user that invokes single-user or maintenance mode is granted privileged access to all system information.If the system is running in EFI mode, SLES 12 by default will use GRUB 2 EFI as the boot loader.

Check content

Verify that the SUSE operating system has set an encrypted root password. Note: If the system does not use Unified Extensible Firmware Interface (UEFI) this requirement is Not Applicable. Check that the encrypted password is set for root with the following command: # sudo cat /boot/efi/EFI/sles12/grub.cfg | grep -i password password_pbkdf2 root grub.pbkdf2.sha512.10000.VeryLongString If the root password entry does not begin with "password_pbkdf2", this is a finding.

Fix text

Note: If the system does not use UEFI, this requirement is Not Applicable. Configure the SUSE operating system to encrypt the boot password. Generate an encrypted (GRUB 2) password for root with the following command: # sudo grub2-mkpasswd-pbkdf2 Enter Password: Reenter Password: PBKDF2 hash of your password is grub.pbkdf2.sha512.10000.MFU48934NJD84NF8NSD39993JDHF84NG Using the hash from the output, modify the "/etc/grub.d/40_custom" file with the following command to add a boot password for the root entry: # cat << EOF set superusers="root" password_pbkdf2 root grub.pbkdf2.sha512.VeryLongString EOF Generate an updated "grub.conf" file with the new password using the following commands: # sudo grub2-mkconfig --output=/tmp/grub2.cfg # sudo mv /tmp/grub2.cfg /boot/efi/EFI/sles12/grub.cfg

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer