Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-756 | GEN000020 | SV-38318r1_rule | IAIA-1 IAIA-2 | Medium |
Description |
---|
If the system does not require valid root authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. If the system does not require valid root authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. |
STIG | Date |
---|---|
HP-UX 11.31 Security Technical Implementation Guide | 2012-05-25 |
Check Text ( C-36228r1_chk ) |
---|
Check if the system is configured to require a password before entering single-user mode using swlist: 1. Perform: swlist | grep -i BOOTAUTH11i 2. Verify the BOOTAUTH11i product is installed/listed. 3. Verify the existence of the /etc/default/security file. 4. Ensure the entry BOOT_AUTH=1 is in /etc/default/security. 5. If steps 2-4 cannot be verified, this is a finding. |
Fix Text (F-31487r1_fix) |
---|
Configure the system to require a password before entering single-user mode via the following: 1. Perform: swlist | grep -i BOOTAUTH11i 2. Verify the BOOTAUTH11i product is installed/listed. 3. If not installed, acquire the BOOTAUTH11i product from HP. 4. Invoke swinstall and install the BOOTAUTH11i product. 5. Verify the existence of the /etc/default/security file. 6. If not present, create the /etc/default/security file. 7. The file /etc/default/security must be root-owned with permissions not greater than 644 and group-owned by root, bin, sys, or other. 8. Add the entry BOOT_AUTH=1 in the /etc/default/security file. |