BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

RHEL-09-611195 RHEL 9 must require authentication to access emergency mode.

DISA STIG library V2R10
All changes in this version
first version loaded CAT II

Maps to AC-3 via CCI-000213

Title

RHEL 9 must require authentication to access emergency mode.

Control

Verify RHEL 9 requires authentication for emergency mode with the following command: $ grep sulogin /usr/lib/systemd/system/emergency.service ExecStart=-/usr/lib/systemd/systemd-sulogin-shell emergency If the line is not returned from the default systemd file, use the following command to look for modifications to the emergency.service: $ grep sulogin /etc/systemd/system/emergency.service.d/*.conf If the line is not returned from either location this is a finding. Note: The configuration setting can only be in either the default location, or in the drop in file, not both locations.

Discussion

To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoW-approved PKIs, all DoW systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement. This requirement prevents attackers with physical access from trivially bypassing security on the machine and gaining root access. Such accesses are further prevented by configuring the bootloader password.

Related controls

CCI-000213

Fix

Configure RHEL 9 to require authentication for emergency mode. Create a directory for supplementary configuration files: $ sudo mkdir /etc/systemd/system/emergency.service.d/ Create a new file: $ sudo vi /etc/systemd/system/emergency.service.d/emergency.service.conf Add these lines to the new file: [Service] ExecStart= ExecStart=-/usr/lib/systemd/systemd-sulogin-shell emergency Apply changes to unit files without rebooting the system: $ sudo systemctl daemon-reload