Detections
Analytics

1.21 OL09-00-000050

Information

OL 9 must require a unique superuser's name upon booting into single-user and maintenance modes.

GROUP ID: V-271451
RULE ID: SV-271451r1137691

Having a nondefault grub superuser username makes password-guessing attacks less effective.

Solution

Configure OL 9 to have a unique username for the grub superuser account.

Edit the "/etc/grub.d/01_users" file and add or modify the following lines in the "### BEGIN /etc/grub.d/01_users ###" section:

set superusers="superusers-account"
export superusers

Once the superuser account has been added, update the grub.cfg file by running:

$ sudo grubby --update-kernel=ALL'

See Also

https://workbench.cisecurity.org/benchmarks/27024

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-3, CCI|CCI-000213, Rule-ID|SV-271451r1137691_rule, STIG-ID|OL09-00-000050, Vuln-ID|V-271451

Plugin: Unix

Control ID: 1c4f1c4d6f54d02c85fa5e04ab86b6c4c14507b7ee9a78c1b47689c2ac525599