STIGQter: STIG Summary: Canonical Ubuntu 18.04 LTS Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 23 Apr 2021:

Ubuntu operating systems booted with a BIOS must require authentication upon booting into single-user and maintenance modes.

DISA Rule

SV-219147r610963_rule

Vulnerability Number

V-219147

Group Title

SRG-OS-000080-GPOS-00048

Rule Version

UBTU-18-010000

Severity

CAT I

CCI(s)

• CCI-000213 - The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

Weight

10

Fix Recommendation

Configure the system to require a password for authentication upon booting into single-user and maintenance modes.

Generate an encrypted (grub) password for root with the following command:

# grub-mkpasswd-pbkdf2
Enter Password:
Reenter Password:
PBKDF2 hash of your password is grub.pbkdf2.sha512.10000.MFU48934NJD84NF8NSD39993JDHF84NG

Using the hash from the output, modify the "/etc/grub.d/40_custom" file with the following command to add a boot password:

# sudo sed -i '$i set superusers=\"root\"\npassword_pbkdf2 root <hash>' /etc/grub.d/40_custom

where <hash> is the hash generated by grub-mkpasswd-pbdkf2 command.

Generate an updated "grub.conf" file with the new password by using the following command:

# update-grub

Check Contents

Verify that an encrypted root password is set. This is only applicable on systems that use a basic Input/Output System BIOS.

Run the following command to verify the encrypted password is set:

# grep –i password /boot/grub/grub.cfg

password_pbkdf2 root grub.pbkdf2.sha512.10000.MFU48934NJA87HF8NSD34493GDHF84NG

If the root password entry does not begin with “password_pbkdf2”, this is a finding.

Vulnerability Number

V-219147

Documentable

False

Rule Version

UBTU-18-010000

Severity Override Guidance

Verify that an encrypted root password is set. This is only applicable on systems that use a basic Input/Output System BIOS.

Run the following command to verify the encrypted password is set:

# grep –i password /boot/grub/grub.cfg

password_pbkdf2 root grub.pbkdf2.sha512.10000.MFU48934NJA87HF8NSD34493GDHF84NG

If the root password entry does not begin with “password_pbkdf2”, this is a finding.

Check Content Reference

M

Target Key

4055

Comments