Detections
Analytics

1.192 SOL-11.1-080140

Information

The system must require authentication before allowing modification of the boot devices or menus. Secure the GRUB Menu (Intel).

GROUP ID: V-216218RULE ID: SV-216218r959010

The flexibility that GRUB provides creates a security risk if its configuration is modified by an unauthorized user. The failsafe menu entry needs to be secured in the same environments that require securing the systems firmware to avoid unauthorized removable media boots.

Solution

The root role is required.

This action applies to the global zone only. Determine the zone that you are currently securing.

zonename

If the command output is "global", this action applies.

Update GRUB to use a custom configuration file.

pfedit /rpool/boot/grub/grub.cfgInsert the line:source $prefix/custom.cfg

Create a password hash.

/usr/lib/grub2/bios/bin/grub-mkpasswd-pbkdf2Enter password:Reenter password:Your PBKDF2 is .......Copy the long password hash in its entirety.

pfedit /rpool/boot/grub/custom.cfgInsert the lines:set superusers="[username]"password_pbkdf2 [username] [password hash]

Restart the system.

See Also

https://workbench.cisecurity.org/benchmarks/23873

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|III, CCI|CCI-000366, Rule-ID|SV-216218r959010_rule, STIG-ID|SOL-11.1-080140, Vuln-ID|V-216218

Plugin: Unix

Control ID: 7e4b1eace14660cffe40209166f11592a643a39af3a8d96c8cf39357249f1009