Red Hat ENTERPRISE LINUX 5 - VIRTUAL SERVER ADMINISTRATION, Руководство по развертыванию

Страница: 631 / 848

Password Security
605
Next, edit the GRUB configuration file
/boot/grub/grub.conf
. Open the file and below the
timeout
line in the main section of the document, add the following line:
password --md5 <password-hash>
Replace
<password-hash>
with the value returned by
/sbin/grub-md5-crypt
2
.
The next time the system boots, the GRUB menu prevents access to the editor or command interface
without first pressing
p
followed by the GRUB password.
Unfortunately, this solution does not prevent an attacker from booting into an insecure operating
system in a dual-boot environment. For this, a different part of the
/boot/grub/grub.conf
file must
be edited.
Look for the
title
line of the operating system that you want to secure, and add a line with the
lock
directive immediately beneath it.
For a DOS system, the stanza should begin similar to the following:
title DOS lock
Warning
A
password
line must be present in the main section of the
/boot/grub/grub.conf
file for this method to work properly. Otherwise, an attacker can access the GRUB editor
interface and remove the lock line.
To create a different password for a particular kernel or operating system, add a
lock
line to the
stanza, followed by a password line.
Each stanza protected with a unique password should begin with lines similar to the following
example:
title DOS lock password --md5 <password-hash>
43.1.3. Password Security
Passwords are the primary method that Red Hat Enterprise Linux uses to verify a user's identity. This
is why password security is so important for protection of the user, the workstation, and the network.
For security purposes, the installation program configures the system to use
Message-Digest
Algorithm
(
MD5
) and shadow passwords. It is highly recommended that you do not alter these
settings.
If MD5 passwords are deselected during installation, the older
Data Encryption Standard
(
DES
) format
is used. This format limits passwords to eight alphanumeric characters (disallowing punctuation and
other special characters), and provides a modest 56-bit level of encryption.
If shadow passwords are deselected during installation, all passwords are stored as a one-way hash
in the world-readable
/etc/passwd
file, which makes the system vulnerable to offline password
GRUB also accepts unencrypted passwords, but it is recommended that an MD5 hash be used for added security.