Detections
Analytics

1.193 SOL-11.1-080130

Information

The system must require passwords to change the boot device settings. (SPARC)

GROUP ID: V-216454
RULE ID: SV-216454r959010

Setting the EEPROM password helps prevent attackers who gain physical access to the system console from booting from an external device (such as a CD-ROM or floppy).

Solution

The root role is required.

This action applies to the global zone only. Determine the zone that you are currently securing.

# zonename

If the command output is "global", this action applies.

# eeprom security-mode=command

After entering the command above, the administrator will be prompted for a password. This password will be required to authorize any future command issued at boot-level on the system (the ok or > prompt) except for the normal multi-user boot command (i.e., the system will be able to reboot unattended).

Write down the password and store it in a secure location.

See Also

https://workbench.cisecurity.org/benchmarks/23765

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|III, CCI|CCI-000366, Rule-ID|SV-216454r959010_rule, STIG-ID|SOL-11.1-080130, Vuln-ID|V-216454

Plugin: Unix

Control ID: 88bb87c94812f0e65104ee08f53991f83c4c1d12e8d9cc895460763a6bc16ec6