highsystemverified ✓

Require a GRUB password for single-user and maintenance boot

grub-single-user-password · UBUNTU ≥ 22 · 1 impl

Description

A GRUB superuser password (password_pbkdf2 root) must be present in /boot/grub/grub.cfg so that booting into single-user or maintenance mode requires authentication.

Rationale

Without a bootloader password, anyone with console access can edit the kernel command line or boot into single-user (root) mode and bypass all operating-system access controls.

Check → Remediate

Checkcommand

# STIG: a 'password_pbkdf2 root ...' entry must exist in the compiled
# grub.cfg (needs root to read; run under --sudo).
if grep -iqE '^[[:space:]]*password_pbkdf2[[:space:]]+root([[:space:]]|$)' /boot/grub/grub.cfg 2>/dev/null; then
  echo "OK: GRUB root password_pbkdf2 is set"; exit 0
fi
echo "FAIL: no 'password_pbkdf2 root' entry in /boot/grub/grub.cfg"; exit 1

expected_exit:: 0

Remediatemanual

note:: Generate a hash with grub-mkpasswd-pbkdf2, add 'set superusers="root"' and 'password_pbkdf2 root <hash>' to /etc/grub.d/40_custom, then run update-grub.

Framework references

STIG

V-270675 / UBTU-24-102000V-260470 / UBTU-22-212010

NIST 800-53

AC-3

Live verification

ubuntu22:checkubuntu24:check

#grub#bootloader#single-user#password#stig