STIGQter: STIG Summary: Oracle Linux 8 Security Technical Implementation Guide Version: 2 Release: 9 Benchmark Date: 01 Jul 2026:

OL 8 operating systems booted with a BIOS must require authentication upon booting into single-user and maintenance modes.

DISA Rule

SV-248540r1137691_rule

Vulnerability Number

V-248540

Group Title

SRG-OS-000080-GPOS-00048

Rule Version

OL08-00-010150

Severity

CAT I

CCI(s)

• CCI-000213 - Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

Weight

10

Fix Recommendation

Configure the system to require a grub bootloader password for the grub superusers account with the grub2-setpassword command, which creates/overwrites the "/boot/grub2/user.cfg" file.

Generate an encrypted grub2 password for the grub superusers account with the following command:

$ sudo grub2-setpassword
Enter password:
Confirm password:

Check Contents

For systems that use UEFI, this is not applicable.

Determine if an encrypted password is set for the grub superusers account. On systems that use a BIOS, use the following command:

$ sudo grep -iw grub2_password /boot/grub2/user.cfg

GRUB2_PASSWORD=grub.pbkdf2.sha512.[password_hash]

If the grub superusers account password does not begin with "grub.pbkdf2.sha512", this is a finding.

Vulnerability Number

V-248540

Documentable

False

Rule Version

OL08-00-010150

Severity Override Guidance

For systems that use UEFI, this is not applicable.

Determine if an encrypted password is set for the grub superusers account. On systems that use a BIOS, use the following command:

$ sudo grep -iw grub2_password /boot/grub2/user.cfg

GRUB2_PASSWORD=grub.pbkdf2.sha512.[password_hash]

If the grub superusers account password does not begin with "grub.pbkdf2.sha512", this is a finding.

Check Content Reference

M

Target Key

5416