Title

The LILO Boot Loader password is not encrypted. (Cat I impact)

Discussion

On newer linux systems, the lilo password can be hashed in a separate file. To determine if the lilo password is encrypted perform the following: # grep password /etc/lilo.conf If the returned line contains password=””, then perform the following: # more /etc/lilo.conf.crc If the file does not exist, this is a finding.

Check Content

On newer Linux systems, the LILO password can be hashed in a separate file. To determine if the LILO password is encrypted perform the following: # grep password /etc/lilo.conf If the returned line contains password=””, then perform the following: # more /etc/lilo.conf.crc If the system uses the LILO boot loader, and the file does not exist, this is a finding.

Fix Text

Configure LILO for encrypted passwords.

Additional Identifiers

Rule ID: SV-12537r2_rule

Vulnerability ID: V-12036

Group Title: LILO Boot Loader Encrypted Password

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.