1.490 - systems prior to version 7.2 using Unified Extensible Firmware Interface (UEFI) must require authentication upon booting into single-user and maintenance modes - password

Information

If the system does not require valid root authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. GRUB 2 is the default boot loader for RHEL 7 and is designed to require a password to boot into single-user mode or make modifications to the boot menu.

Solution

Configure the system to encrypt the boot password for root.

Generate an encrypted grub2 password for root with the following command:

Note: The hash generated is an example.

# grub2-mkpasswd-pbkdf2

Enter Password:
Reenter Password:
PBKDF2 hash of your password is grub.pbkdf2.sha512.10000.F3A7CFAA5A51EED123BE8238C23B25B2A6909AFC9812F0D45

Edit '/etc/grub.d/40_custom' and add the following lines below the comments:

# vi /etc/grub.d/40_custom

set superusers='root'

password_pbkdf2 root {hash from grub2-mkpasswd-pbkdf2 command}

Generate a new 'grub.conf' file with the new password with the following commands:

# grub2-mkconfig --output=/tmp/grub2.cfg
# mv /tmp/grub2.cfg /boot/efi/EFI/fedora/grub.cfg

See Also

https://docs.fedoraproject.org/f28/system-administrators-guide/index.html

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-7(9), CAT|I, CCI|CCI-000213

Plugin: Unix

Control ID: 73dee675d1ef70dc38f79144a819788eed610c013018714a58dce85054fb4ca1