# Ensure bootloader password is set

Necessity: Setting a bootloader password is a critical physical security control. It prevents unauthorized users with console access from modifying boot parameters (e.g., booting into single-user mode) to bypass system security, reset the root password, or boot from an alternative medium to compromise the system's integrity. Without this protection, an attacker with physical access can easily gain privileged control over the operating system.

Auditing and Remediation: The audit script verifies that the GRUB2 configuration file ('/boot/grub2/grub.cfg') contains the necessary directives ('set superusers' and 'password_pbkdf2') that indicate a password has been set. The remediation script leverages the standard 'grub2-setpassword' utility, which is the recommended method for generating a hashed password and correctly configuring the bootloader files to enforce it.

Recommended State Rationale: This is a foundational security setting with a binary state (either enabled or disabled). Basic: The recommended state is 'Enabled' as the risk of not having a bootloader password is significant for any production system. Moderate: The state remains 'Enabled' as there is no intermediate level of security for this control. Strict: The state is also 'Enabled'. For all security postures, the principle is the same: physical or console access must not be allowed to bypass system-level authentication and authorization controls.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

shell script that checks if a superuser and a password hash are set in '/boot/grub2/grub.cfg'. The script should grep for lines starting with 'set superusers' and 'password_pbkdf2'. If both lines are found, the script must output only the string 'Enabled'; otherwise, it must output only 'Disabled'.

## Remediation Script Working

shell script that accepts one positional argument: 'Enabled'. If the argument is 'Enabled', the script should execute the 'grub2-setpassword' command, which will interactively prompt the administrator to create a new bootloader password. The script must return 'true' if the command exits successfully (exit code 0), and 'false' otherwise.

