TMA-FREEBSD-1.3.1

Ensure bootloader password is set

HighLevel 1Automatedfreebsd

Description

Setting the boot loader password will require that anyone rebooting the system must enter a password before being able to set command line boot parameters. Requiring a boot password upon execution of the boot loader will prevent an unauthorized user from entering boot parameters or changing the boot partition. This prevents users from weakening security (e.g. reducing kernel security level at boot time). Audit: a password= line must be present in /boot/loader.conf (it is stored in plain text).

How it is checked

Audit method: File pattern

File: /boot/loader.conf
Pattern: (?m)^\s*password\s*=\s*"?\S

How it is fixed

Fix method: Guidance or infrastructure patch

Add password to the /boot/loader.conf file by having an entry like the following: password=Jmklvqqq8MCqg91L

Properties

Operating systems: Any
Tags: freebsdpassword-policy
Reference: CIS FreeBSD 14 Benchmark v1.0.1 - 1.3.1 Ensure bootloader password is set

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target freebsd