Ensure bootloader password is set

Како се проверава

Метод провере: Команда љуске

f=/boot/grub/grub.cfg; [ -r "$f" ] || exit 1
grep -q '^set superusers' "$f" || { echo 'no superusers in grub.cfg'; exit 1; }
grep -Eq '^\s*password(_pbkdf2)?\s' "$f" && echo compliant || echo 'no bootloader password in grub.cfg'

Очекивани излаз

compliant

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

Create an encrypted password with grub-mkpasswd-pbkdf2: # grub-mkpasswd-pbkdf2 Enter password: <password> Reenter password: <password> Your PBKDF2 is <encrypted-password> Add the following into a custom /etc/grub.d configuration file: cat <<EOF set superusers="<username>" password_pbkdf2 <username> <encrypted-password> EOF ** The superuser/user information and password should not be contained in the /etc/grub.d/00_header file as this file could be overwritten in a package update.** If there is a requirement to be able to boot/reboot without entering the password, edit /etc/grub.d/10_linux and add --unrestricted to the line CLASS= Example: CLASS="--class gnu-linux --class gnu --class os ...

Проверите овај рачунар

Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.

tmaegis scan --target ros