The system must require authentication upon booting into single-user and maintenance modes.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-756	GEN000020	SV-38318r1_rule	IAIA-1 IAIA-2	Medium

Description

If the system does not require valid root authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. If the system does not require valid root authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system.

STIG	Date
HP-UX 11.31 Security Technical Implementation Guide	2013-06-27

Details

Check Text ( C-36228r1_chk )
Check if the system is configured to require a password before entering single-user mode using swlist: 1. Perform: swlist | grep -i BOOTAUTH11i 2. Verify the BOOTAUTH11i product is installed/listed. 3. Verify the existence of the /etc/default/security file. 4. Ensure the entry BOOT_AUTH=1 is in /etc/default/security. 5. If steps 2-4 cannot be verified, this is a finding.

Fix Text (F-31487r1_fix)

Configure the system to require a password before entering single-user mode via the following: 1. Perform: swlist | grep -i BOOTAUTH11i 2. Verify the BOOTAUTH11i product is installed/listed. 3. If not installed, acquire the BOOTAUTH11i product from HP. 4. Invoke swinstall and install the BOOTAUTH11i product. 5. Verify the existence of the /etc/default/security file. 6. If not present, create the /etc/default/security file. 7. The file /etc/default/security must be root-owned with permissions not greater than 644 and group-owned by root, bin, sys, or other. 8. Add the entry BOOT_AUTH=1 in the /etc/default/security file.