# Ensure bootloader password is set

Necessity: Setting a bootloader password is a critical physical security control. Without it, an attacker with physical access to the machine can interrupt the boot process, edit GRUB boot parameters to enter single-user mode, and gain root access to the system without credentials. This bypasses all operating system-level user authentication. It also prevents unauthorized changes to kernel parameters or booting from alternate media to compromise the system.

Auditing and Remediation: The audit script verifies that the active GRUB configuration (`/boot/grub/grub.cfg`) contains a `password_pbkdf2` directive, which confirms a password has been set. The remediation script automates the process of creating a GRUB user configuration file, populating it with a superuser and a secure password hash, and running `update-grub` to integrate this protection into the bootloader configuration.

Recommended State Rationale: This is a binary security control; the password is either set or it is not. There are no intermediate levels of protection. Therefore, for any security posture—Basic, Moderate, or Strict—the only acceptable state is 'Enabled'. The risk posed by an unprotected bootloader is high for any server or workstation where physical access cannot be completely restricted, making this a foundational hardening requirement.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

bash script that inspects the primary GRUB configuration file (`/boot/grub/grub.cfg`) to determine if a bootloader password is set. The script should check for the existence of a `password_pbkdf2` entry. If this entry is found, the script must output the string 'Enabled'. If it is not found, the script must output 'Disabled'. The output must contain only the status string and no other text or formatting.

## Remediation Script Working

bash script that accepts a single argument: 'Enabled'. If the argument is 'Enabled', the script must configure a GRUB superuser (e.g., 'root') and set a password for it. This process involves creating a new GRUB configuration file (e.g., /etc/grub.d/01_users), adding the user and a pre-generated PBKDF2 password hash, and then executing `update-grub` to apply the changes. The script must be designed to accept the pre-generated hash via a secure method as a second argument or environment variable. The script must return `true` on successful application and `false` on failure.

