documentation_complete: true

prodtype: rhel7,fedora

title: 'Set Boot Loader Password'

description: "The grub2 boot loader should have a superuser account and password\nprotection enabled to protect boot-time settings.\n<br /><br />\nTo do so, select a superuser account name and password and and modify the\n<tt>/etc/grub.d/01_users</tt> configuration file with the new account name.\n<br /><br />\nSince plaintext passwords are a security risk, generate a hash for the pasword\nby running the following command:\n<pre>$ grub2-setpassword</pre>\nWhen prompted, enter the password that was selected. \n<br /><br />\nNOTE: It is recommended not to use common administrator account names like root,\nadmin, or administrator for the grub2 superuser account. \n<br /><br />\nChange the superuser to a different username (The default is 'root').\n<pre>$ sed -i s/root/bootuser/g /etc/grub.d/01_users</pre>\n<br /><br />\nTo meet FISMA Moderate, the bootloader superuser account and password MUST \ndiffer from the root account and password.\nOnce the superuser account and password have been added,\
    \ update the \n<tt>grub.cfg</tt> file by running:\n<pre>grub2-mkconfig -o /boot/grub2/grub.cfg</pre>\nNOTE: Do NOT manually add the superuser account and password to the \n<tt>grub.cfg</tt> file as the grub2-mkconfig command overwrites this file."

rationale: |-
    Password protection on the boot loader configuration ensures
    users with physical access cannot trivially alter
    important bootloader settings. These include which kernel to use,
    and whether to enter single-user mode. For more information on how to configure
    the grub2 superuser account and password, please refer to
    <ul>
    <li><weblink-macro link="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System_Administrators_Guide/sec-Protecting_GRUB_2_with_a_Password.html" /></li>.
    </ul>

severity: high

identifiers:
    cce@rhel7: 27309-4

references:
    cis: 1.4.2
    cui: 3.4.5
    disa: 213
    hipaa: 164.308(a)(1)(ii)(B),164.308(a)(7)(i),164.308(a)(7)(ii)(A),164.310(a)(1),164.310(a)(2)(i),164.310(a)(2)(ii),164.310(a)(2)(iii),164.310(b),164.310(c),164.310(d)(1),164.310(d)(2)(iii)
    nist: IA-2(1),IA-5(e),AC-3
    ospp@rhel7: FIA_AFL.1
    srg: SRG-OS-000080-GPOS-00048
    stigid@rhel7: "010480"

ocil_clause: 'it does not'

ocil: |-
    To verify the boot loader superuser account has been set, run the following
    command:
    <pre>sudo grep -A1 "superusers\|password" /etc/grub2.cfg</pre>
    The output should show the following:
    <pre>set superusers="<b>superusers-account</b>"
    export superusers
    password_pbkdf2 <b>superusers-account</b> <b>${GRUB2_PASSWORD}</b></pre>
    To verify the boot loader superuser account password has been set,
    and the password encrypted, run the following command:
    <pre>sudo cat /boot/grub2/user.cfg</pre>
    The output should be similar to:
    <pre>GRUB2_PASSWORD=grub.pbkdf2.sha512.10000.C4E08AC72FBFF7E837FD267BFAD7AEB3D42DDC
    2C99F2A94DD5E2E75C2DC331B719FE55D9411745F82D1B6CFD9E927D61925F9BBDD1CFAA0080E0
    916F7AB46E0D.1302284FCCC52CD73BA3671C6C12C26FF50BA873293B24EE2A96EE3B57963E6D7
    0C83964B473EC8F93B07FE749AA6710269E904A9B08A6BBACB00A2D242AD828</pre>
