STIGQter: STIG Summary: Red Hat Enterprise Linux 10 Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

RHEL 10 must require authentication to access emergency mode.

DISA Rule

SV-281327r1167131_rule

Vulnerability Number

V-281327

Group Title

SRG-OS-000080-GPOS-00048

Rule Version

RHEL-10-701250

Severity

CAT II

CCI(s)

• CCI-000213 - Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

Weight

10

Fix Recommendation

Configure RHEL 10 to require authentication for emergency mode.

Create a directory for supplementary configuration files:

$ sudo mkdir /etc/systemd/system/emergency.service.d/

Copy the original "emergency.service" file to the new directory with:

$ sudo cp /usr/lib/systemd/system/emergency.service /etc/systemd/system/emergency.service.d/emergency.service.conf

Open the new file:

$ sudo vi /etc/systemd/system/emergency.service.d/emergency.service.conf

Add or modify the following line in the new file:

ExecStart=-/usr/lib/systemd/systemd-sulogin-shell emergency

Comment out or remove the ExecStart and ExecStartPre lines in "/usr/lib/systemd/system/emergency.service" as they can only exist in one location.

Apply changes to unit files without rebooting the system:

$ sudo systemctl daemon-reload

Check Contents

Verify RHEL 10 requires authentication for emergency mode with the following command:

$ sudo grep systemd-sulogin /usr/lib/systemd/system/emergency.service
# ExecStart=-/usr/lib/systemd/systemd-sulogin-shell emergency

If the line is not returned from the default "systemd" file, use the following command to look for modifications to "emergency.service":

$ sudo grep systemd-sulogin /etc/systemd/system/emergency.service.d/*.conf
ExecStart=-/usr/lib/systemd/systemd-sulogin-shell emergency

If the line is not returned from either location, this is a finding.

Note: The configuration setting can be in either the default location or the drop-in file but not in both locations.

Vulnerability Number

V-281327

Documentable

False

Rule Version

RHEL-10-701250

Severity Override Guidance

Verify RHEL 10 requires authentication for emergency mode with the following command:

$ sudo grep systemd-sulogin /usr/lib/systemd/system/emergency.service
# ExecStart=-/usr/lib/systemd/systemd-sulogin-shell emergency

If the line is not returned from the default "systemd" file, use the following command to look for modifications to "emergency.service":

$ sudo grep systemd-sulogin /etc/systemd/system/emergency.service.d/*.conf
ExecStart=-/usr/lib/systemd/systemd-sulogin-shell emergency

If the line is not returned from either location, this is a finding.

Note: The configuration setting can be in either the default location or the drop-in file but not in both locations.

Check Content Reference

M

Target Key

5733