---
title: "HOST-BOOT-001 Boot Loader Has No Password"
canonical: https://openvapt.com/checks/HOST-BOOT-001.html
html: https://openvapt.com/checks/HOST-BOOT-001.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# HOST-BOOT-001 Boot Loader Has No Password

Checks that GRUB is configured with a superuser and a hashed password so the boot entries cannot be edited at the console.

- Domain: Server
- Severity: Medium
- Control category: Access Control
- Fix effort: medium
- CVSS v3.1 vector: `CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
- CIS Controls v8: 4.1
- NIST CSF 2.0: PR.PS-01
- CWE: CWE-306
- NIST SP 800-53 Rev. 5: AC-3, AC-6, CM-6
- Benchmark topic: Boot loader password (CIS Controls v8 4.1) (topic only, no benchmark text)

## Why It Matters

Without a boot loader password anyone at the console or virtual console can edit the kernel command line (for example add init=/bin/bash) and get a root shell without any credentials, bypassing every control on the running system.

## How It Detects

Reads /boot/grub/grub.cfg, /boot/grub2/grub.cfg, /boot/grub2/user.cfg, /boot/efi/EFI/*/grub.cfg, /boot/efi/EFI/*/user.cfg and /etc/grub.d/* and looks for  set superusers=  together with  password_pbkdf2  (or password). Only the presence of these directives is reported; hashes are never shown. Skipped when no GRUB configuration exists; incomplete when a file exists but cannot be read.

## How to Fix

Run  grub-mkpasswd-pbkdf2  (grub2-setpassword on RHEL family), add  set superusers="admin"  and  password_pbkdf2 admin <hash>  to /etc/grub.d/40_custom (RHEL family writes /boot/grub2/user.cfg), then regenerate with  update-grub  or  grub2-mkconfig -o /boot/grub2/grub.cfg. Add  --unrestricted  to the normal menu entry so unattended reboots still work.

## How to Verify

```
grep -E 'set superusers|password_pbkdf2' /boot/grub/grub.cfg /boot/grub2/grub.cfg /boot/grub2/user.cfg /etc/grub.d/* 2>/dev/null | sed 's/grub.pbkdf2.*/<hash>/'
```

## Learn the Theory

- [P17 Kernel, Filesystem and Boot Hardening](https://openvapt.com/academy/p17.md)

## References

- [GNU GRUB Manual, Security](https://www.gnu.org/software/grub/manual/grub/html_node/Security.html)
- [NIST SP 800-123, Guide to General Server Security](https://csrc.nist.gov/pubs/sp/800/123/final)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/boot.go

Run it: `openvapt scan --only HOST-BOOT-001`. Read it offline: `openvapt explain HOST-BOOT-001`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/HOST-BOOT-001.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.