MediumOS hardeningBLWK-PRIV-002

No GRUB boot loader password is set

What this means

/boot/grub/grub.cfg has no password or password_pbkdf2 directive. Anyone with physical or console access to this machine can interrupt the boot menu and edit kernel parameters directly (e.g. appending init=/bin/bash or single) to get a root shell without ever needing a valid credential — no OS-level control can prevent this once someone has unrestricted access to the boot menu itself.

How to fix it

Set a GRUB password: run grub-mkpasswd-pbkdf2 to generate a hash, add set superusers="root" and password_pbkdf2 root <hash> to /etc/grub.d/40_custom, then run update-grub. IMPORTANT: on stock Ubuntu/Debian, set superusers makes GRUB prompt for that password before booting ANY entry — the machine will halt at a password prompt on every reboot, including unattended ones. To keep normal boot automatic and only gate editing entries and recovery, append --unrestricted to the CLASS list of your default menuentry (edit /etc/grub.d/10_linux, or use a submenu). Test with a reboot you can physically recover from before relying on this on a headless host.

Check it yourself

Run a scan and look for BLWK-PRIV-002 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads grub_password and reports this check when:

password_set == false

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• CIS Benchmark 1.4.1
• MITRE ATT&CK T1542

Related checks

• Cron entry runs a downloader piped to a shell · BLWK-ACCT-001
• Password maximum age is excessively long · BLWK-ACCT-002
• Password minimum age is zero · BLWK-ACCT-003
• Password hashing rounds are not explicitly configured · BLWK-ACCT-004
• Default UMASK is not explicitly configured · BLWK-ACCT-005
• A sensitive system file is world-writable · BLWK-FS-001