STIGQter: STIG Summary: Oracle Linux 8 Security Technical Implementation Guide Version: 2 Release: 9 Benchmark Date: 01 Jul 2026:

OL 8 operating systems booted with United Extensible Firmware Interface (UEFI) must require authentication upon booting into single-user mode and maintenance.

DISA Rule

SV-248537r1137691_rule

Vulnerability Number

V-248537

Group Title

SRG-OS-000080-GPOS-00048

Rule Version

OL08-00-010140

Severity

CAT I

CCI(s)

• CCI-000213 - Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

Weight

10

Fix Recommendation

Configure the system to require an encrypted grub bootloader password for the grub superusers account with the grub2-setpassword command, which creates/overwrites the "/boot/efi/EFI/redhat/user.cfg" file.

Generate an encrypted grub2 password for the grub superusers account with the following command:

$ sudo grub2-setpassword
Enter password:
Confirm password:

Check Contents

For systems that use BIOS, this is not applicable.

Determine if an encrypted password is set for the grub superusers account. On systems that use UEFI, use the following command:

$ sudo grep -iw grub2_password /boot/efi/EFI/redhat/user.cfg

GRUB2_PASSWORD=grub.pbkdf2.sha512.[password_hash]

If the grub superusers account password does not begin with "grub.pbkdf2.sha512", this is a finding.

Vulnerability Number

V-248537

Documentable

False

Rule Version

OL08-00-010140

Severity Override Guidance

For systems that use BIOS, this is not applicable.

Determine if an encrypted password is set for the grub superusers account. On systems that use UEFI, use the following command:

$ sudo grep -iw grub2_password /boot/efi/EFI/redhat/user.cfg

GRUB2_PASSWORD=grub.pbkdf2.sha512.[password_hash]

If the grub superusers account password does not begin with "grub.pbkdf2.sha512", this is a finding.

Check Content Reference

M

Target Key

5416