documentation_complete: true


title: 'Set the UEFI Boot Loader Password'

description: |-
    The grub2 boot loader should have a superuser account and password
    protection enabled to protect boot-time settings.
    <br /><br />
    Since plaintext passwords are a security risk, generate a hash for the password
    by running the following command:
    {{% if product in ["sle12", "sle15", "slmicro5", "slmicro6", "ubuntu2204", "ubuntu2404"] %}}
    <pre># grub2-mkpasswd-pbkdf2</pre>
    {{% else %}}
    <pre># grub2-setpassword</pre>
    {{% endif %}}
    When prompted, enter the password that was selected.
    <br /><br />
    {{% if product in ["sle12", "sle15", "slmicro5", "slmicro6", "ubuntu2204", "ubuntu2404"] %}}
    Using the hash from the output, modify the <tt>/etc/grub.d/40_custom</tt>
    file with the following content:
    <pre>set superusers="boot"
    password_pbkdf2 boot grub.pbkdf2.sha512.VeryLongString
    </pre>
    NOTE: the bootloader superuser account and password MUST differ from the
    root account and password.
    Once the superuser password has been added,
    update the
    <tt>grub.cfg</tt> file by running:
    {{%- if "rhel" in product %}}
    <pre>grub2-mkconfig -o /boot/grub2/grub.cfg</pre>
    {{%- else %}}
    <pre>{{{ grub_command("update") }}}</pre>
    {{%- endif %}}
    {{% endif %}}

rationale: |-
    Password protection on the boot loader configuration ensures
    users with physical access cannot trivially alter
    important bootloader settings. These include which kernel to use,
    and whether to enter single-user mode.

severity: high

identifiers:
    cce@rhcos4: CCE-82552-1
    cce@rhel8: CCE-80829-5
    cce@rhel9: CCE-88654-9
    cce@rhel10: CCE-89236-4
    cce@sle12: CCE-83045-5
    cce@sle15: CCE-83275-8
    cce@sle16: CCE-96406-4
    cce@slmicro5: CCE-93779-7
    cce@slmicro6: CCE-94671-5

references:
    cis-csc: 11,12,14,15,16,18,3,5
    cis@sle12: 1.5.1
    cis@sle15: 1.5.1
    cobit5: DSS05.02,DSS05.04,DSS05.05,DSS05.07,DSS06.03,DSS06.06
    cui: 3.4.5
    hipaa: 164.308(a)(1)(ii)(B),164.308(a)(7)(i),164.308(a)(7)(ii)(A),164.310(a)(1),164.310(a)(2)(i),164.310(a)(2)(ii),164.310(a)(2)(iii),164.310(b),164.310(c),164.310(d)(1),164.310(d)(2)(iii)
    isa-62443-2009: 4.3.3.2.2,4.3.3.5.1,4.3.3.5.2,4.3.3.5.3,4.3.3.5.4,4.3.3.5.5,4.3.3.5.6,4.3.3.5.7,4.3.3.5.8,4.3.3.6.1,4.3.3.6.2,4.3.3.6.3,4.3.3.6.4,4.3.3.6.5,4.3.3.6.6,4.3.3.6.7,4.3.3.6.8,4.3.3.6.9,4.3.3.7.1,4.3.3.7.2,4.3.3.7.3,4.3.3.7.4
    isa-62443-2013: 'SR 1.1,SR 1.10,SR 1.11,SR 1.12,SR 1.13,SR 1.2,SR 1.3,SR 1.4,SR 1.5,SR 1.6,SR 1.7,SR 1.8,SR 1.9,SR 2.1,SR 2.2,SR 2.3,SR 2.4,SR 2.5,SR 2.6,SR 2.7'
    iso27001-2013: A.6.1.2,A.7.1.1,A.9.1.2,A.9.2.1,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5
    nist: CM-6(a)
    nist-csf: PR.AC-4,PR.AC-6,PR.PT-3
    ospp: FIA_UAU.1
    srg: SRG-OS-000080-GPOS-00048
    stigid@ol7: OL07-00-010491
    stigid@ol8: OL08-00-010140
    stigid@sle12: SLES-12-010440
    stigid@sle15: SLES-15-010200

ocil_clause: 'no password is set'

ocil: |-
    To verify the boot loader superuser password has been set, run the following command:
    $ sudo grep "^[\s]*GRUB2_PASSWORD=grub\.pbkdf2\.sha512.*$" {{{ grub2_uefi_boot_path }}}/user.cfg
    The output should be similar to:
    <pre>GRUB2_PASSWORD=grub.pbkdf2.sha512.10000.C4E08AC72FBFF7E837FD267BFAD7AEB3D42DDC
    2C99F2A94DD5E2E75C2DC331B719FE55D9411745F82D1B6CFD9E927D61925F9BBDD1CFAA0080E0
    916F7AB46E0D.1302284FCCC52CD73BA3671C6C12C26FF50BA873293B24EE2A96EE3B57963E6D7
    0C83964B473EC8F93B07FE749AA6710269E904A9B08A6BBACB00A2D242AD828</pre>


warnings:
    - general: |-
        To prevent hard-coded passwords, automatic remediation of this control is not available. Remediation
        must be automated as a component of machine provisioning, or followed manually as outlined above.

        Also, do NOT manually add the superuser account and password to the
        <tt>grub.cfg</tt> file as the grub2-mkconfig command overwrites this file.


fixtext: |-
    Configure {{{ full_name }}} to use a secure UEFI boot loader password.

    Run the following command:
    $ sudo grub2-setpassword

    When prompted, enter the password that was selected.
    Using the hash from the output, modify the "/etc/grub.d/40_custom" file with the following content:
    Use a unique account name for the superusers account.

    set superusers="superusers-account"
    password_pbkdf2 superusers-account grub.pbkdf2.sha512.$password_hash

    Then, update the grub.cfg file by running:

    {{%- if "rhel" in product %}}
    <pre>grub2-mkconfig -o /boot/grub2/grub.cfg</pre>
    {{%- else %}}
    <pre>{{{ grub_command("update") }}}</pre>
    {{%- endif %}}

srg_requirement: '{{{ full_name }}} systems with United Extensible Firmware Interface (UEFI) must require authentication upon booting into single-user mode and maintenance.'