SV-230234r1262176: RHEL 8 operating systems booted with United Extensible Firmware Interface (UEFI) must require authentication upon booting into single-user mode and maintenance. | Red Hat Enterprise Linux 8 STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

RHEL 8 operating systems booted with United Extensible Firmware Interface (UEFI) must require authentication upon booting into single-user mode and maintenance.

Description

Discussion Text

If the system does not require valid authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. GRUB 2 is the default boot loader for RHEL 8 and is designed to require a password to boot into single-user mode or make modifications to the boot menu.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000213

References

DPMS Target Red Hat Enterprise Linux 8 DISA DPMS Target Red Hat Enterprise Linux 8 2921

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

#!/bin/bash
# Reconstructed from oval:mil.disa.stig.rhel8os:def:230234
# RHEL 8 operating systems booted with United Extensible Firmware Interface (UEFI) must require authentication upon booting into single-user mode and maintenance.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.

# /etc/grub2.cfg:superusers exists and has a name.
# textfilecontent54_object (textfilecontent54_test)
test_1() {
  (sed -En 's/^\s*set\s+superusers\s*=\s*"(\w+)"\s*$/\1/p' '/etc/grub2-efi.cfg') | grep -Pq '^\S+$'
}
# /boot/grub2/user.cfg:GRUB2_PASSWORD exists and has a PBKDF2/SHA512 password assigned.
# textfilecontent54_object (textfilecontent54_test)
test_2() {
  (sed -En 's/^\s*GRUB2_PASSWORD=(\S+)\b/\1/p' '/boot/grub2/user.cfg') | grep -Pq '^grub\.pbkdf2\.sha512\.'
}
# /boot/efi/EFI/redhat/user.cfg:GRUB2_PASSWORD exists and has a PBKDF2/SHA512 password assigned.
# textfilecontent54_object (textfilecontent54_test)
test_3() {
  (sed -En 's/^\s*GRUB2_PASSWORD=(\S+)\b/\1/p' '/boot/efi/EFI/redhat/user.cfg') | grep -Pq '^grub\.pbkdf2\.sha512\.'
}

if ( test_1 && ( test_2 || test_3 ) ); then
  echo "PASS"
else
  echo "FAIL"
fi

Assessment Script Powered by AISandbox-executed

A standalone Shell script to assess this control automatically. Review before running it in your environment.

Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.

#!/bin/sh
# OVAL Definition: oval:mil.disa.stig.rhel8os:def:230234

if [ ! -f "/etc/grub2-efi.cfg" ]; then echo "PASS"; exit 0; fi
if ! grep -q "^\\s*set\\s+superusers\\s*=\\s*\"(\\w+)\"\\s*$" /etc/grub2-efi.cfg; then echo "FAIL"; exit 1; fi

if [ ! -f "/boot/grub2/user.cfg" ]; then echo "PASS"; exit 0; fi
if ! grep -q "^\\s*GRUB2_PASSWORD=(\\S+)\\b" /boot/grub2/user.cfg; then
  if [ ! -f "/boot/efi/EFI/redhat/user.cfg" ]; then echo "PASS"; exit 0; fi
  if ! grep -q "^\\s*GRUB2_PASSWORD=(\\S+)\\b" /boot/efi/EFI/redhat/user.cfg; then echo "FAIL"; exit 1; fi
fi

echo "PASS"; exit 0

Remediation

Configure the system to require a GRUB bootloader password for the grub superusers account.

Use the "grub2-setpassword" command, which automatically creates and sets the correct permissions for the unified "/boot/grub2/user.cfg" file using the required PBKDF2 SHA512 hashing algorithm.

Generate the encrypted GRUB 2 password with the following command:

# grub2-setpassword
Enter password: 
Confirm password: 

Note: Do not manually edit the GRUB configuration files to set this password; always use the provided utility to ensure the correct hashing algorithm is applied and the file is placed in the active configuration directory.