From Red Hat Enterprise Linux 7 Security Technical Implementation Guide
Part of SRG-OS-000080-GPOS-00048
Associated with: CCI-000213
If the system does not require valid root authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. GRUB 2 is the default boot loader for RHEL 7 and is designed to require a password to boot into single-user mode or make modifications to the boot menu.
For systems that use UEFI, this is Not Applicable. Check to see if an encrypted root password is set. On systems that use a BIOS, use the following command: # grep -i ^password_pbkdf2 /boot/grub2/grub.cfg password_pbkdf2 [superusers-account] [password-hash] If the root password entry does not begin with "password_pbkdf2", this is a finding. If the "superusers-account" is not set to "root", this is a finding.
Configure the system to encrypt the boot password for root. Generate an encrypted grub2 password for root with the following command: Note: The hash generated is an example. # grub2-mkpasswd-pbkdf2 Enter Password: Reenter Password: PBKDF2 hash of your password is grub.pbkdf2.sha512.10000.F3A7CFAA5A51EED123BE8238C23B25B2A6909AFC9812F0D45 Edit "/etc/grub.d/40_custom" and add the following lines below the comments: # vi /etc/grub.d/40_custom set superusers="root" password_pbkdf2 root {hash from grub2-mkpasswd-pbkdf2 command} Generate a new "grub.conf" file with the new password with the following commands: # grub2-mkconfig --output=/tmp/grub2.cfg # mv /tmp/grub2.cfg /boot/grub2/grub.cfg
Lavender hyperlinks in small type off to the right (of CSS
class id, if you view the page source) point to
globally unique URIs for each document and item. Copy the
link location and paste anywhere you need to talk
unambiguously about these things.
You can obtain data about documents and items in other
formats. Simply provide an HTTP header Accept:
text/turtle or
Accept: application/rdf+xml.
Powered by sagemincer