In the previous section:

Configuring and Securing SELinux

was completed.

1. CIS Benchmark Requirements (Section 1.4)

This article covers and implements the following CIS controls related to securing the boot process:

• 1.4.1 Ensure bootloader password is set (Automated)
• 1.4.2 Ensure access to bootloader config is configured (Automated)

2. Concept & Rationale

In Linux, the Bootloader (GRUB2 in Oracle Linux 9) is responsible for loading the kernel.

• Preventing kernel parameter tampering: If a GRUB password is not set, anyone (or an attacker) with access to the physical or virtual console (VNC/Console in hypervisors) can press e in the boot menu and modify kernel parameters. This allows an attacker to disable SELinux, boot the system into single-user mode (or with init=/bin/bash), and change the root password without knowing the previous one—gaining full control of the system.
• Configuration confidentiality: Because the configured password is stored as a hashed value in configuration files, read access to these files must be strictly restricted. Proper permissions ensure normal users cannot read the hash and export it for offline password cracking attacks (Brute-force/Dictionary).

3. Compatibility with Oracle Database (RAC & Grid)

No conflict:

Setting a bootloader password does not interfere with system startup, automatic reboots, or the operation of Oracle Database or Oracle Clusterware services (Grid Infrastructure).

The boot process runs automatically, and the GRUB password is requested only if someone attempts to edit the boot command line interactively. Therefore, it has no negative impact on the High Availability of Oracle services.

4. How to Audit the Current Status (Audit Script)

This script checks whether a password is configured and whether GRUB2 configuration file permissions are secured:

Link to this script on GitHub:

modules/audit_05_Secure_Bootloader_GRUB2.sh

If you are not familiar with Bash scripting, you can refer to the tutorial I have published on the website for DBAs.

Bash for Oracle DBAs

#!/bin/bash
# Script: audit_cis_1_4.sh
# Purpose: Audit Bootloader Configuration (CIS 1.4)

echo "=========================================================================="
echo " CIS Requirement: 1.4 Secure Bootloader Configuration"
echo " - Ensure bootloader password is set."
echo " - Ensure bootloader config file permissions are secure."
echo " Oracle Context: Setting a GRUB password prevents unauthorized access to"
echo " single-user mode. It does NOT impact Oracle DB/RAC/Grid operations as"
echo " they run post-boot and do not interact with the bootloader."
echo "=========================================================================="

FAIL_COUNT=0

echo -e "\n[*] 1. Checking GRUB password configuration..."
if [ -s /boot/grub2/user.cfg ] && grep -q "^GRUB2_PASSWORD=" /boot/grub2/user.cfg; then
echo -e " \e[32m[PASS]\e[0m GRUB password is set in /boot/grub2/user.cfg."
else
echo -e " \e[31m[FAIL]\e[0m GRUB password is NOT configured (/boot/grub2/user.cfg missing or empty)."
FAIL_COUNT=$((FAIL_COUNT + 1))
fi

echo -e "\n[*] 2. Checking permissions of GRUB config files..."
for file in /boot/grub2/grub.cfg /boot/grub2/user.cfg; do
if [ -e "$file" ]; then
PERM=$(stat -c "%a %U %G" "$file")
if [[ "$PERM" == "400 root root" || "$PERM" == "600 root root" ]]; then
echo -e " \e[32m[PASS]\e[0m $file permissions are secure ($PERM)."
else
echo -e " \e[31m[FAIL]\e[0m $file has insecure permissions ($PERM). Expected 400 or 600 root root."
FAIL_COUNT=$((FAIL_COUNT + 1))
fi
else
# Only fail if it's grub.cfg, since missing user.cfg is already caught in step 1
if [ "$file" == "/boot/grub2/grub.cfg" ]; then
echo -e " \e[31m[FAIL]\e[0m $file does not exist."
FAIL_COUNT=$((FAIL_COUNT + 1))
fi
fi
done

if [ "$FAIL_COUNT" -eq 0 ]; then
echo -e "\n\e[32m[+] AUDIT RESULT: PASS\e[0m"
else
echo -e "\n\e[31m[-] AUDIT RESULT: FAIL ($FAIL_COUNT issues found)\e[0m"
fi

(Note: On older Oracle Linux versions and UEFI environments, file paths were different, but in Oracle Linux 9 the main files are located under the standard /boot/grub2/ path.)

5. How to Apply Settings (Remediation Bash Script)

This script uses the operating system’s standard tool to create a default password and then tightens permissions.

Link to this script on GitHub:

modules/remediate_05_Secure_Bootloader_GRUB2.sh

#!/bin/bash
# Script: remediate_cis_1_4.sh
# Purpose: Secure Bootloader Configuration (CIS 1.4)

if [ "$EUID" -ne 0 ]; then echo "Please run as root"; exit 1; fi

echo -e "\n[+] Applying Remediation for Bootloader (CIS 1.4)..."

# 1. Set GRUB Password (CIS 1.4.1)
echo "[*] Configuring GRUB2 password..."
if [ ! -s /boot/grub2/user.cfg ]; then
echo " [!] Please enter a strong password for the GRUB bootloader:"
# Calling it directly allows interactive hidden input without stty errors
grub2-setpassword

if [ $? -eq 0 ]; then
echo " [+] GRUB password set successfully."
else
echo " [-] Failed to set GRUB password."
fi
else
echo " [-] GRUB password is already configured. Skipping to prevent overwrite."
fi

# 2. Set strict permissions (CIS 1.4.2)
echo -e "\n[*] Restricting permissions on GRUB configuration files..."

if [ -f /boot/grub2/grub.cfg ]; then
chown root:root /boot/grub2/grub.cfg
chmod 0400 /boot/grub2/grub.cfg
echo " [+] Secured /boot/grub2/grub.cfg (set to 400 root root)"
fi

if [ -f /boot/grub2/user.cfg ]; then
chown root:root /boot/grub2/user.cfg
chmod 0400 /boot/grub2/user.cfg
echo " [+] Secured /boot/grub2/user.cfg (set to 400 root root)"
fi

echo -e "\n[+] Bootloader secured successfully."

In the next part, we will cover

Process Hardening and Core Dump Management

.