Navigate

Check: RHEL-09-212020

RHEL 9 STIG: RHEL-09-212020 (in versions v1 r3 through v1 r1)

Title

RHEL 9 must require a unique superusers name upon booting into single-user and maintenance modes. (Cat I impact)

Discussion

Having a nondefault grub superuser username makes password-guessing attacks less effective.

Check Content

Verify the boot loader superuser account has been set with the following command: $ sudo grep -A1 "superusers" /etc/grub2.cfg set superusers="<superusers-account>" export superusers The <superusers-account> is the actual account name different from common names like root, admin, or administrator. If superusers contains easily guessable usernames, this is a finding.

Fix Text

Configure RHEL 9 to have a unique username for the grub superuser account. Edit the "/etc/grub.d/01_users" file and add or modify the following lines in the "### BEGIN /etc/grub.d/01_users ###" section: set superusers="superusers-account" export superusers Once the superuser account has been added, update the grub.cfg file by running: $ sudo grubby --update-kernel=ALL

Additional Identifiers

Rule ID: SV-257789r943055_rule

Vulnerability ID: V-257789

Group Title: SRG-OS-000080-GPOS-00048

Expert Comments

Expert comments are only available to logged-in users.

CCIs

CCIs tied to check.

Number	Definition
CCI-000213	The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

Controls

Controls tied to check. These are derived from the CCIs shown above.

Number	Title
AC-3	Access Enforcement