STIGQter: STIG Summary: Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide Version: 1 Release: 6 Benchmark Date: 01 Jul 2026:

Ubuntu 24.04 LTS when booted must require authentication upon booting into single-user and maintenance modes.

DISA Rule

SV-270675r1137691_rule

Vulnerability Number

V-270675

Group Title

SRG-OS-000080-GPOS-00048

Rule Version

UBTU-24-102000

Severity

CAT I

CCI(s)

CCI-000213 - Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

Weight

Fix Recommendation

Configure the system to require a password for authentication upon booting into single-user and maintenance modes.

Generate an encrypted (grub) password for root with the following command:

$ grub-mkpasswd-pbkdf2
Enter Password:
Reenter Password:
PBKDF2 hash of your password is grub.pbkdf2.sha512.10000.MFU48934NJD84NF8NSD39993JDHF84NG

Using the hash from the output, modify the "/etc/grub.d/40_custom" file with the following command to add a boot password:

$ sudo sed -i '$i set superusers=\"root\"\npassword_pbkdf2 root <hash>' /etc/grub.d/40_custom

where <hash> is the hash generated by grub-mkpasswd-pbkdf2 command.

Generate an updated "grub.conf" file with the new password by using the following command:

$ sudo update-grub

Check Contents

Verify Ubuntu 24.04 LTS requires a password for authentication upon booting into single-user and maintenance modes with the following command:

$ sudo grep -i password /boot/grub/grub.cfg
password_pbkdf2 root grub.pbkdf2.sha512.10000.MFU48934NJA87HF8NSD34493GDHF84NG

If the root password entry does not begin with "password_pbkdf2", this is a finding.

Vulnerability Number

V-270675

Documentable

False

Rule Version

UBTU-24-102000

Severity Override Guidance

Check Content Reference

Target Key

5673