Ensure bootloader password is set

How it is checked

Audit method: Shell command

f=/boot/grub/grub.cfg; [ -r "$f" ] || exit 1
grep -q '^set superusers' "$f" || { echo 'no superusers in grub.cfg'; exit 1; }
grep -Eq '^\s*password(_pbkdf2)?\s' "$f" && echo compliant || echo 'no bootloader password in grub.cfg'

Expected output

compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Create an encrypted password with grub-mkpasswd-pbkdf2: # grub-mkpasswd-pbkdf2 Enter password: <password> Reenter password: <password> Your PBKDF2 is <encrypted-password> Add the following into a custom /etc/grub.d configuration file: cat <<EOF set superusers="<username>" password_pbkdf2 <username> <encrypted-password> EOF ** The superuser/user information and password should not be contained in the /etc/grub.d/00_header file as this file could be overwritten in a package update.** If there is a requirement to be able to boot/reboot without entering the password, edit /etc/grub.d/10_linux and add --unrestricted to the line CLASS= Example: CLASS="--class gnu-linux --class gnu --class os ...

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

tmaegis scan --target ros