{ "id": "CB-UBU-BOOT-011", "standard": "ubuntu", "version": "main", "url": "https://baselines.cirsec.org/b/ubuntu/CB-UBU-BOOT-011", "json": "https://baselines.cirsec.org/b/ubuntu/CB-UBU-BOOT-011.json", "yaml": "https://baselines.cirsec.org/b/ubuntu/CB-UBU-BOOT-011.yml", "profiles_effective": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "license": "Text CC BY 4.0, code Apache-2.0", "attribution": "CIRSEC Baselines, https://baselines.cirsec.org", "control": { "id": "CB-UBU-BOOT-011", "title": "Protect the boot loader configuration with a password", "finding": { "title": "Anyone at the console can edit the boot entries", "description": "Editing the kernel command line at boot (for example adding init=/bin/sh) gives a root shell without any password." }, "status": "active", "profiles": [ "core" ], "risk": { "severity": "medium" }, "assessment": "automated", "tags": [ "grub", "boot", "physical-access" ], "applicability": { "facts": [ "grub" ] }, "description": "GRUB can require a superuser name and password before anyone edits a boot entry or opens the\nGRUB command line. The password is stored as a PBKDF2 hash in the GRUB configuration.\nMarking the normal boot entries `--unrestricted` keeps unattended boots working: the password\nis only asked to change them.\n", "rationale": "Whoever reaches the console (physically, through a hypervisor console or a remote management\ncard) can otherwise edit the kernel command line, boot into single-user mode or a shell, and\nbypass every account and audit control of the system.\n", "impact": "Editing boot entries or using the GRUB shell during an incident needs the GRUB password. Store\nit with the other break-glass secrets. Boots without changes are not affected.\n", "notes": "Full disk encryption is the stronger protection against offline attacks. The GRUB password\ndoes not protect against booting another medium; restrict that in the firmware settings.\n\n`/etc/grub.d/10_linux` is a configuration file of the `grub-common` package: an upgrade that\nchanges it keeps the local version (unattended-upgrades) or asks. After such an upgrade, check\nthat `--unrestricted` is still on the `CLASS=` line.\n", "setting": { "location": "`/etc/grub.d/40_custom` (or another file in `/etc/grub.d/`), compiled into `/boot/grub/grub.cfg`", "default_value": "No password", "recommended_value": "A superuser and a PBKDF2 password hash" }, "audit": { "manual": "In `/boot/grub/grub.cfg`, check that a `set superusers=` line and a `password_pbkdf2` line exist.\n", "checks": [ { "id": "superusers", "engine": "file-content", "description": "A GRUB superuser is declared.", "spec": { "path": "/boot/grub/grub.cfg", "pattern": "^\\s*set\\s+superusers=" } }, { "id": "password", "engine": "file-content", "description": "The superuser has a PBKDF2 password.", "spec": { "path": "/boot/grub/grub.cfg", "pattern": "^\\s*password_pbkdf2\\s+" } } ] }, "remediation": { "manual": "1. Generate a hash: `grub-mkpasswd-pbkdf2`.\n2. Append to `/etc/grub.d/40_custom`:\n ```\n set superusers=\"root\"\n password_pbkdf2 root grub.pbkdf2.sha512.10000.\n ```\n3. To keep normal boots unattended, add `--unrestricted` to the `CLASS=` line of\n `/etc/grub.d/10_linux`, or to each `menuentry` you want bootable without a password.\n4. Run `update-grub`, then reboot once from the console to confirm the default entry still boots.\n", "rollback": "Remove the two lines from `/etc/grub.d/40_custom` and run `update-grub`.\n" }, "references": [ { "title": "grub-mkpasswd-pbkdf2(1), Ubuntu manual pages", "url": "https://manpages.ubuntu.com/manpages/noble/man1/grub-mkpasswd-pbkdf2.1.html", "publisher": "Canonical", "kind": "vendor-doc", "accessed": "2026-10-19" }, { "title": "GNU GRUB Manual - Authentication and authorisation", "url": "https://www.gnu.org/software/grub/manual/grub/html_node/Authentication-and-authorisation.html", "publisher": "GNU Project", "kind": "vendor-doc", "accessed": "2026-10-19" }, { "title": "ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R5)", "url": "https://messervices.cyber.gouv.fr/documents-guides/fr_np_linux_configuration-v2.0.pdf", "publisher": "ANSSI", "kind": "guide", "accessed": "2026-10-19" } ], "mappings": [ { "framework": "anssi-linux", "framework_version": "2.0", "id": "R5", "relation": "equivalent" }, { "framework": "nist-800-53r5", "framework_version": "5.1.1", "id": "AC-3", "relation": "related" } ], "threats": [ { "framework": "mitre-attack", "id": "T1542" } ], "authors": [ { "name": "Alice", "github": "Sn0wAlice" } ], "verified": [ { "date": "2026-10-19", "by": "Sn0wAlice", "versions": [ "20.04" ], "environment": "Proxmox VM, Ubuntu 20.04 cloud image, kernel 5.4.0-216-generic, BIOS boot", "notes": "Manual procedure applied (PBKDF2 hash in 40_custom, --unrestricted on the CLASS line of 10_linux); check passes; unattended reboot works." }, { "date": "2026-10-19", "by": "Sn0wAlice", "versions": [ "22.04" ], "environment": "Proxmox VM, Ubuntu 22.04 cloud image, kernel 5.15.0-198-generic, BIOS boot", "notes": "Manual procedure applied (PBKDF2 hash in 40_custom, --unrestricted on the CLASS line of 10_linux); check passes; unattended reboot works." }, { "date": "2026-10-19", "by": "Sn0wAlice", "versions": [ "24.04" ], "environment": "Proxmox VM, Ubuntu 24.04 cloud image, kernel 6.8.0-147-generic, BIOS boot", "notes": "Manual procedure applied (PBKDF2 hash in 40_custom, --unrestricted on the CLASS line of 10_linux); check passes; unattended reboot works." }, { "date": "2026-10-19", "by": "Sn0wAlice", "versions": [ "26.04" ], "environment": "Proxmox VM, Ubuntu 26.04 cloud image, kernel 7.0.0-38-generic, BIOS boot", "notes": "Manual procedure applied (PBKDF2 hash in 40_custom, --unrestricted on the CLASS line of 10_linux); check passes; unattended reboot works." } ], "introduced_in": "0.1.0", "created": "2026-10-19", "updated": "2026-10-19" } }