Automatically regenerate and enforce bootloader configurations
In rare cases, it might be useful to enable automatic regeneration of the bootloader configuration, and you might want to set a bootloader password. By setting a bootloader password, you can provide an extra layer of security for your infrastructure.
grub2.CEM for Linux enforces various bootloader configurations as required by the selected compliance framework and benchmark. However, because changes to bootloader configurations can be potentially dangerous, a minimalistic approach to configuration changes is used by CEM for Linux.
Several CIS recommendations modify the bootloader config. If you run CEM for Linux with the full range of default settings, these changes will be applied, but the bootloader config will not be regenerated. While changes are pending on the node, bootloader operations remain the same until the configurations are regenerated. The exception to this is the bootloader password, which is not set by default. To learn how to configure CEM for Linux to automatically regenerate the bootloader config and set the bootloader password, see the following topics: