Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide

The Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide (V1 R8) has 439 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

439STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R8

CurrentPublished Wed Sep 30 2026

ALMA 9 must require authentication upon booting into single-user and maintenance modes.

Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide

Assessment Title

Rule Text

ALMA 9 must require authentication upon booting into single-user and maintenance modes.

Description

Discussion Text

Password protection on the boot loader configuration ensures users with physical access cannot trivially alter important bootloader settings. These include which kernel to use, and whether to enter single-user mode.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-269137

Rule

SV-269137r1261562_rule

Severity

medium

Rule Version

ALMA-09-006290

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Verify that ALMA 9 requires a password for the GRUB 2 bootloader to prevent unauthorized modifications to boot parameters.

Check the unified configuration file where the GRUB 2 password is stored:

# sudo grep -iw "GRUB2_PASSWORD" /boot/grub2/user.cfg
GRUB2_PASSWORD=grub.pbkdf2.sha512.[password_hash]

If the "GRUB2_PASSWORD" entry does not exist, is commented out, or if the hash does not begin with "grub.pbkdf2.sha512", this is a finding.

Implementation Procedure

Fix Text

Configure AlmaLinux OS 9 to require a grub bootloader password for the grub superuser account.

Generate an encrypted grub2 password for the grub superuser account with the following command:

$ grub2-setpassword
Enter password:
Confirm password:

STIG check 31 of 439 in the Cloud Linux AlmaLinux OS 9 STIG checklist

← Previous · V-269136AlmaLinux OS 9 must require authentication to access emergency mode.Next · V-269138 →AlmaLinux OS 9 must require a unique superuser's name upon booting into single-user and maintenance modes.