The system must require passwords to change the boot device settings. (SPARC)

From Solaris 11 SPARC Security Technical Implementation Guide

Associated with: CCI-000366

SV-60875r1_rule The system must require passwords to change the boot device settings. (SPARC)

Vulnerability discussion

Setting the EEPROM password helps prevent attackers who gain physical access to the system console from booting from an external device (such as a CD-ROM or floppy).

Check content

This check applies only to SPARC-based systems. This check applies to the global zone only. Determine the zone that you are currently securing. # zonename If the command output is "global", this check applies. Determine if the EEPROM security mode on SPARC-based systems is configured correctly. # eeprom security-mode If the output of this command is not "security-mode=command", this is a finding.

Fix text

The root role is required. This action applies to the global zone only. Determine the zone that you are currently securing. # zonename If the command output is "global", this action applies. # eeprom security-mode=command After entering the command above, the administrator will be prompted for a password. This password will be required to authorize any future command issued at boot-level on the system (the ok or > prompt) except for the normal multi-user boot command (i.e., the system will be able to reboot unattended). Write down the password and store it in a secure location.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.