Secure the GRUB Menu (Intel)

보통레벨 1자동solaris

설명

GRUB is a boot loader for x64 based systems that permits loading an OS image from any location. Oracle x64 systems support the use of a GRUB Menu password for the console. The flexibility that GRUB provides creates a security risk if its configuration is modified by an unauthorized user. Audit: on x86 systems /rpool/boot/grub/grub.cfg must source password.cfg; SPARC systems are compliant.

점검 방법

감사 방식: 셸 명령

shell

if [ "$(uname -p)" = i386 ]; then grep -q "password.cfg" /rpool/boot/grub/grub.cfg 2>/dev/null && echo compliant || echo "GRUB menu password not configured"; else echo compliant; fi

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Run the following command to generate your password hash: # /usr/lib/grub2/bios/bin/grub-mkpasswd-pbkdf2 Enter password: Reenter password: PBKDF2 hash of your password is <em><password_hash></em> Create the file /usr/lib/grub2/bios/etc/grub.d/01\_password: #!/bin/sh /usr/bin/cat > /rpool/boot/grub/password.cfg<<EOF # # GRUB password # set superusers="root" password_pbkdf2 root <em><password_hash></em> EOF /usr/bin/chmod 600 /rpool/boot/grub/password.cfg /usr/bin/echo 'source /@/boot/grub/password.cfg' Run the following to finalize the password configuration and set menu timeout: # /usr/bin/chmod 700 /usr/lib/grub2/bios/etc/grub.d/01_password # /usr/sbin/bootadm set-menu timeout=30 Changes will take effect on the next reboot.

속성

운영 체제: 모두
태그: solarishardening
참고 자료: CIS Oracle Solaris 11.4 Benchmark v1.1.0 - 6.15 Secure the GRUB Menu (Intel)

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target solaris