documentation_complete: true

title: 'Set Boot Loader Password'

description: |-
    The grub boot loader should have password protection
    enabled to protect boot-time settings.
    To do so, select a password and then generate a hash from it by running the following command:
    <pre>$ grub-crypt --sha-512</pre>
    When prompted to enter a password, insert the following line into <tt>/etc/grub.conf</tt>
    immediately after the header comments. (Use the output from <tt>grub-crypt</tt> as the
    value of <b>password-hash</b>):
    <pre>password --encrypted <b>password-hash</b></pre>
    NOTE: To meet FISMA Moderate, the bootloader password MUST differ from the root password.

rationale: |-
    Password protection on the boot loader configuration ensures
    users with physical access cannot trivially alter
    important bootloader settings. These include which kernel to use,
    and whether to enter single-user mode.

severity: medium

identifiers:
    cce: 26911-8

references:
    disa: 213
    nist: 'IA-2(1),IA-5(e) AC-3'
    srg: SRG-OS-000080
    stigid: RHEL-06-000068

ocil_clause: 'it does not'

ocil: |-
    To verify the boot loader password has been set and encrypted, run the following command:
    <pre>$ sudo grep password /etc/grub.conf</pre>
    The output should show the following:
    <pre>password --encrypted <b>password-hash</b></pre>
