Set Boot Loader Password in grub2
Protects the grub2 boot loader with a superuser and a PBKDF2 password so boot parameters cannot be altered at the console without authentication.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Password protection on the boot loader configuration prevents an attacker with physical or console access from trivially altering critical bootloader settings. Without it, anyone at the console can edit the kernel command line, boot into single-user mode or pass init=/bin/bash, gaining an unauthenticated root shell and bypassing every OS-level control.
What Pavois checks
Pavois greps the rendered grub.cfg (and /etc/grub.d/) for a set superusers plus a password_pbkdf2/password directive. It inspects the effective generated config across BIOS (/boot/grub, /boot/grub2) and EFI (/boot/efi/EFI/*/grub.cfg) layouts, so it catches a password that is only present after grub-mkconfig/grub2-mkconfig regenerates the file, not just a template fragment.
describe command('grep -rqsE \'^[[:space:]]*(set[[:space:]]+superusers|password_pbkdf2|password)\' /boot/grub/grub.cfg /boot/grub2/grub.cfg /boot/efi/EFI/*/grub.cfg /etc/grub.d/ 2>/dev/null && echo ok || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
Run grep -E '^(set superusers|password_pbkdf2|password)' /boot/grub/grub.cfg /boot/grub2/grub.cfg (adjust the path to your layout). Expected: at least one set superusers="..." line and one password_pbkdf2 <user> grub.pbkdf2.sha512... line.
Inspect & investigate
There is no runtime log for this control; the evidence is the generated config. Verify with grep -E 'superusers|password_pbkdf2' /boot/grub2/grub.cfg and check the source in /etc/grub.d/ and /etc/grub.d/40_custom. Regeneration is triggered by grub2-mkconfig / update-grub.
Remediation
pavois harden apply runs the grub_password resource: it defines a grub superuser, hashes the supplied password with PBKDF2, writes it into the grub.d snippet, and regenerates the boot config. The change is reboot_required: true. Important: Pavois appends --unrestricted to the standard boot entries so the password is only required to edit entries or reach the grub shell, not for every normal boot.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command_apt | H=$(printf "%s\n%s\n" "$(cat %{pwfile})" "$(cat %{pwfile})" | grub-mkpasswd-pbkdf2 2>/dev/null | grep -oE "grub\.pbkdf2\.[^ ]+"); [ -n "$H" ] && { printf "%s\n" "$H" > /etc/grub.d/.pavois-grub-hash; chmod 0600 /etc/grub.d/.pavois-grub-hash; grep -q -- "--unrestricted" /etc/grub.d/10_linux || sed -ri "/^CLASS=/ s/\"$/ --unrestricted\"/" /etc/grub.d/10_linux; sed -ri "/^GRUB_DISABLE_SUBMENU=/d" /etc/default/grub; echo "GRUB_DISABLE_SUBMENU=y" >> /etc/default/grub; /usr/sbin/update-grub; } |
|---|---|
| command_rhel | H=$(printf "%s\n%s\n" "$(cat %{pwfile})" "$(cat %{pwfile})" | grub2-mkpasswd-pbkdf2 2>/dev/null | grep -oE "grub\.pbkdf2\.[^ ]+"); [ -n "$H" ] && { echo "GRUB2_PASSWORD=$H" > /boot/grub2/user.cfg; chmod 0600 /boot/grub2/user.cfg; } |
| reboot_required | true |
| resource | grub_password |
| superuser | root |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
If misconfigured this is a full physical-access compromise vector: an attacker at the console boots to root, reads or rewrites disk, and exfiltrates secrets. Precautions before applying: a grub superuser password without --unrestricted blocks every boot and will hang a headless machine at the grub prompt, make sure --unrestricted is set on normal entries (Pavois does this). Record the cleartext password in your password manager; if lost you must boot from rescue media to reset it.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R5 | direct | 2.0 | high |
| CIS | 1.4.1 | direct | per OS, see the benchmark table | high |
| NIST | 3.4.5, CM-6(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.