STIGQter: STIG Summary: SUSE Linux Enterprise Server 15 Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 23 Apr 2021:

SUSE operating systems with Unified Extensible Firmware Interface (UEFI) implemented must require authentication upon booting into single-user mode and maintenance.

DISA Rule

SV-234820r622137_rule

Vulnerability Number

V-234820

Group Title

SRG-OS-000080-GPOS-00048

Rule Version

SLES-15-010200

Severity

CAT I

CCI(s)

• CCI-000213 - The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

Weight

10

Fix Recommendation

Note: If the system does not use UEFI, this requirement is Not Applicable.

Configure the SUSE operating system to encrypt the boot password.

Generate an encrypted (GRUB2) password for root with the following command:

> grub2-mkpasswd-pbkdf2
Enter Password:
Reenter Password:
PBKDF2 hash of your password is grub.pbkdf2.sha512.10000.MFU48934NJD84NF8NSD39993JDHF84NG

Using the hash from the output, modify the "/etc/grub.d/40_custom" file and add the following two lines to add a boot password for the root entry:

set superusers="root"
password_pbkdf2 root grub.pbkdf2.sha512.VeryLongString

Generate an updated "grub.conf" file with the new password using the following commands:

> sudo grub2-mkconfig --output=/tmp/grub2.cfg
> sudo mv /tmp/grub2.cfg /boot/efi/EFI/sles/grub.cfg

Check Contents

Verify that the SUSE operating system has set an encrypted root password.

Note: If the system does not use UEFI, this requirement is Not Applicable.

Check that the encrypted password is set for root with the following command:

> sudo cat /boot/efi/EFI/sles/grub.cfg | grep -i password

password_pbkdf2 root grub.pbkdf2.sha512.10000.VeryLongString

If the root password entry does not begin with "password_pbkdf2", this is a finding.

Vulnerability Number

V-234820

Documentable

False

Rule Version

SLES-15-010200

Severity Override Guidance

Verify that the SUSE operating system has set an encrypted root password.

Note: If the system does not use UEFI, this requirement is Not Applicable.

Check that the encrypted password is set for root with the following command:

> sudo cat /boot/efi/EFI/sles/grub.cfg | grep -i password

password_pbkdf2 root grub.pbkdf2.sha512.10000.VeryLongString

If the root password entry does not begin with "password_pbkdf2", this is a finding.

Check Content Reference

M

Target Key

5274

Comments