STIGQter: STIG Summary: Red Hat Enterprise Linux 9 Security Technical Implementation Guide Version: 2 Release: 9 Benchmark Date: 01 Jul 2026:

RHEL 9 must require a boot loader superuser password.

DISA Rule

SV-257787r1184288_rule

Vulnerability Number

V-257787

Group Title

SRG-OS-000080-GPOS-00048

Rule Version

RHEL-09-212010

Severity

CAT II

CCI(s)

CCI-000213 - Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

Weight

Fix Recommendation

Configure RHEL 9 to require a grub bootloader password for the grub superuser account.

Generate an encrypted grub2 password for the grub superuser account with the following command:

$ sudo grub2-setpassword
Enter password:
Confirm password:

Check Contents

Note: For systems that use UEFI, this is not applicable.

Verify the boot loader superuser password has been set with the following command:

$ sudo grep password_pbkdf2 /etc/grub2.cfg

password_pbkdf2 <superusers-accountname> ${GRUB2_PASSWORD}

To verify the boot loader superuser account password has been set and the password encrypted, run the following command:

$ sudo cat /boot/grub2/user.cfg

GRUB2_PASSWORD=grub.pbkdf2.sha512.10000.C4E08AC72FBFF7E837FD267BFAD7AEB3D42DDC
2C99F2A94DD5E2E75C2DC331B719FE55D9411745F82D1B6CFD9E927D61925F9BBDD1CFAA0080E0
916F7AB46E0D.1302284FCCC52CD73BA3671C6C12C26FF50BA873293B24EE2A96EE3B57963E6D7
0C83964B473EC8F93B07FE749AA6710269E904A9B08A6BBACB00A2D242AD828

If a "GRUB2_PASSWORD" is not set, this is a finding.

Vulnerability Number

V-257787

Documentable

False

Rule Version

RHEL-09-212010

Severity Override Guidance

Check Content Reference

Target Key

5551