Details

If the system allows a user to boot into single-user or maintenance mode without authentication, any user that invokes single-user or maintenance mode is granted privileged access to all system information.

Solution

Note: If the system does not use UEFI, this requirement is Not Applicable.

Configure the SUSE operating system to encrypt the boot password.

Generate an encrypted (GRUB2) password for root with the following command:

> grub2-mkpasswd-pbkdf2
Enter Password:
Reenter Password:
PBKDF2 hash of your password is grub.pbkdf2.sha512.10000.MFU48934NJD84NF8NSD39993JDHF84NG

Using the hash from the output, modify the ‘/etc/grub.d/40_custom’ file and add the following two lines to add a boot password for the root entry:

set superusers=’root’
password_pbkdf2 root grub.pbkdf2.sha512.VeryLongString

Generate an updated ‘grub.conf’ file with the new password using the following commands:

> sudo grub2-mkconfig –output=/tmp/grub2.cfg
> sudo mv /tmp/grub2.cfg /boot/efi/EFI/sles/grub.cfg

Supportive Information

The following resource is also helpful.

• https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_SLES_15_V1R3_STIG.ziphttps://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_SLES_15_V1R3_STIG.zip

This security hardening control applies to the following category of controls within NIST 800-53: Access Control.This control applies to the following type of system Unix.

References

• 800-53|AC-3
• CAT|I
• CCI|CCI-000213
• Rule-ID|SV-234820r622137_rule
• STIG-ID|SLES-15-010200
• STIG-Legacy|SV-91841
• STIG-Legacy|V-77145
• Vuln-ID|V-234820

Source

• Tenable.com/audits