TMA-FREEBSD-1.3.1
Ensure bootloader password is set
Deskripsi
Setting the boot loader password will require that anyone rebooting the system must enter a password before being able to set command line boot parameters. Requiring a boot password upon execution of the boot loader will prevent an unauthorized user from entering boot parameters or changing the boot partition. This prevents users from weakening security (e.g. reducing kernel security level at boot time). Audit: a password= line must be present in /boot/loader.conf (it is stored in plain text).
Cara pemeriksaan
Metode audit: Pola file
- File
/boot/loader.conf- Pola
(?m)^\s*password\s*=\s*"?\S
Cara perbaikan
Metode perbaikan: Panduan atau patch infrastruktur
Add password to the /boot/loader.conf file by having an entry like the following: password=Jmklvqqq8MCqg91L
Properti
- Sistem operasi
- Apa saja
- Tag
- freebsdpassword-policy
- Referensi
- CIS FreeBSD 14 Benchmark v1.0.1 - 1.3.1 Ensure bootloader password is set
Periksa host ini
Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.
tmaegis scan --target freebsd