Detections
Analytics

1.3.1 Ensure bootloader password is set

Information

Setting the boot loader password will require that anyone rebooting the system must enter a password before being able to set command line boot parameters.

Requiring a boot password upon execution of the boot loader will prevent an unauthorized user from entering boot parameters or changing the boot partition. This prevents users from weakening security (e.g. reducing kernel security level at boot time).

Solution

Add password to the /boot/loader.conf file by having an entry like the following:

password=Jmklvqqq8MCqg91L

Impact:

If password protection is enabled, only the designated superuser can edit a Boot Menu.

If Boot menu is set up to boot automatically to a password-protected menu entry the user has no option to back out of the password prompt to select another menu entry.

See Also

https://workbench.cisecurity.org/benchmarks/19044

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|14.6

Plugin: Unix

Control ID: 942bdc9f02bc12cd2b94318d89a88ebaf11580fcb0a228ac20fc32076d3980c9