STIGQter: STIG Summary: Oracle Linux 9 Security Technical Implementation Guide Version: 1 Release: 6 Benchmark Date: 01 Jul 2026:

OL 9 must require a boot loader superuser password.

DISA Rule

SV-271635r1137691_rule

Vulnerability Number

V-271635

Group Title

SRG-OS-000080-GPOS-00048

Rule Version

OL09-00-001115

Severity

CAT II

CCI(s)

CCI-000213 - Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

Weight

Fix Recommendation

Configure OL 9 to require a grub bootloader password for the grub superuser account.

Generate an encrypted grub2 password for the grub superuser account with the following command:

$ sudo grub2-setpassword
Enter password:
Confirm password:

Check Contents

Verify that OL 9 requires a boot loader superuser password with the following command:

$ sudo grep "superusers" /etc/grub2.cfg
password_pbkdf2 superusers-account ${GRUB2_PASSWORD}

To verify the boot loader superuser account password has been set, and the password encrypted, run the following command:

$ sudo cat /boot/grub2/user.cfg
GRUB2_PASSWORD=grub.pbkdf2.sha512.10000.C4E08AC72FBFF7E837FD267BFAD7AEB3D42DDC
2C99F2A94DD5E2E75C2DC331B719FE55D9411745F82D1B6CFD9E927D61925F9BBDD1CFAA0080E0
916F7AB46E0D.1302284FCCC52CD73BA3671C6C12C26FF50BA873293B24EE2A96EE3B57963E6D7
0C83964B473EC8F93B07FE749AA6710269E904A9B08A6BBACB00A2D242AD828

If a "GRUB2_PASSWORD" is not set, this is a finding.

Vulnerability Number

V-271635

Documentable

False

Rule Version

OL09-00-001115

Severity Override Guidance

Check Content Reference

Target Key

5680