Ensure bootloader password is set

VisokaNivo 1Automatskafreebsd

Opis

Setting the boot loader password will require that anyone rebooting the system must enter a password before being able to set command line boot parameters. Requiring a boot password upon execution of the boot loader will prevent an unauthorized user from entering boot parameters or changing the boot partition. This prevents users from weakening security (e.g. reducing kernel security level at boot time). Audit: a password= line must be present in /boot/loader.conf (it is stored in plain text).

Kako se proverava

Metod provere: Obrazac u datoteci

Datoteka: /boot/loader.conf
Obrazac: (?m)^\s*password\s*=\s*"?\S

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Add password to the /boot/loader.conf file by having an entry like the following: password=Jmklvqqq8MCqg91L

Svojstva

Operativni sistemi: Bilo koji
Oznake: freebsdpassword-policy
Referenca: CIS FreeBSD 14 Benchmark v1.0.1 - 1.3.1 Ensure bootloader password is set

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target freebsd