Detections
Analytics
RHEL-09-211045 - The systemd Ctrl-Alt-Delete burst key sequence in RHEL 9 must be disabled.
Warning! Audit Deprecated
This audit has been deprecated and will be removed in a future update.
View Next Audit VersionInformation
A locally logged-on user who presses Ctrl-Alt-Delete when at the console can reboot the system. If accidentally pressed, as could happen in the case of a mixed OS environment, this can create the risk of short-term loss of availability of systems due to unintentional reboot. In a graphical user environment, risk of unintentional reboot from the Ctrl-Alt-Delete sequence is reduced because the user will be prompted before any action is taken.Satisfies: SRG-OS-000324-GPOS-00125, SRG-OS-000480-GPOS-00227
Solution
Configure RHEL 9 to disable the CtrlAltDelBurstAction by adding it to a drop file in a "/etc/systemd/system.conf.d/" configuration file:If no drop file exists, create one with the following command:
$ sudo mkdir -p /etc/systemd/system.conf.d && sudo vi /etc/systemd/system.conf.d/55-CtrlAltDel-BurstAction
Edit the file to contain the setting by adding the following text:
CtrlAltDelBurstAction=none
Reload the daemon for this change to take effect.
$ sudo systemctl daemon-reload
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_RHEL_9_V2R7_STIG.zip
Item Details
Audit Name: DISA Red Hat Enterprise Linux 9 STIG v2r7
References: CAT|I, CCI|CCI-002235, Rule-ID|SV-257784r1155651_rule, STIG-ID|RHEL-09-211045, Vuln-ID|V-257784
Plugin: Unix
Control ID: 21589c932bf9d3d69044d57c349959cecbcf393d27cecc4f6c775d1521e531e0