Ensure bootloader password is set

Kako se proverava

Metod provere: Komanda ljuske

f=/boot/grub/grub.cfg; [ -r "$f" ] || exit 1
grep -q '^set superusers' "$f" || { echo 'no superusers in grub.cfg'; exit 1; }
grep -Eq '^\s*password(_pbkdf2)?\s' "$f" && echo compliant || echo 'no bootloader password in grub.cfg'

Očekivani izlaz

compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Create an encrypted password with grub-mkpasswd-pbkdf2: # grub-mkpasswd-pbkdf2 Enter password: <password> Reenter password: <password> Your PBKDF2 is <encrypted-password> Add the following into a custom /etc/grub.d configuration file: cat <<EOF set superusers="<username>" password_pbkdf2 <username> <encrypted-password> EOF ** The superuser/user information and password should not be contained in the /etc/grub.d/00_header file as this file could be overwritten in a package update.** If there is a requirement to be able to boot/reboot without entering the password, edit /etc/grub.d/10_linux and add --unrestricted to the line CLASS= Example: CLASS="--class gnu-linux --class gnu --class os ...

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

tmaegis scan --target ros