Ensure bootloader password is set

中等級 1自動化ros

說明

Setting the boot loader password will require that anyone rebooting the system must enter a password before being able to set command line boot parameters The audit requires "set superusers" and a password_pbkdf2 entry in /boot/grub/grub.cfg. Host-level control from the CIS ROS Melodic benchmark (Ubuntu 18.04 robot hosts); run as root.

檢查方式

稽核方法: Shell 指令

shell

f=/boot/grub/grub.cfg; [ -r "$f" ] || exit 1
grep -q '^set superusers' "$f" || { echo 'no superusers in grub.cfg'; exit 1; }
grep -Eq '^\s*password(_pbkdf2)?\s' "$f" && echo compliant || echo 'no bootloader password in grub.cfg'

預期輸出: compliant

修補方式

修補方法: 操作指南或基礎設施修補檔

Create an encrypted password with grub-mkpasswd-pbkdf2: # grub-mkpasswd-pbkdf2 Enter password: <password> Reenter password: <password> Your PBKDF2 is <encrypted-password> Add the following into a custom /etc/grub.d configuration file: cat <<EOF set superusers="<username>" password_pbkdf2 <username> <encrypted-password> EOF ** The superuser/user information and password should not be contained in the /etc/grub.d/00_header file as this file could be overwritten in a package update.** If there is a requirement to be able to boot/reboot without entering the password, edit /etc/grub.d/10_linux and add --unrestricted to the line CLASS= Example: CLASS="--class gnu-linux --class gnu --class os ...

屬性

作業系統: 不限
標籤: rosros1melodicsystem
參考資料: CIS ROS Melodic Benchmark v1.0.0 - 1.5.2 Ensure bootloader password is set

檢查此主機

請在您有權稽核的機器上執行此指令。掃描為唯讀操作。

shell

tmaegis scan --target ros