Weblogs for alish
#1
Posted by alish on Sun 9 Dec 2007 at 06:05
Restricting system reboots through the console
If your system has a keyboard attached to it anyone (yes anyone) can reboot the system through it without login to the system. This might, or might not, adhere to your security policy. If you want to restrict this, you must check the /etc/inittab so that the line that includes ctrlaltdel calls shutdown with the -a switch (remember to run init q after making any changes to this file). The default in Debian includes this switch:
ca:12345:ctrlaltdel:/sbin/shutdown -t1 -a -r now
Now, in order to allow some users to shutdown the system, as the manpage shutdown(8) describes, you must create the file /etc/shutdown.allow and include there the name of users which can boot the system. When the three finger salute (a.k.a. ctrl+alt+del) is given the program will check if any of the users listed in the file are logged in. If none of them is, shutdown will not reboot the system.
If your system has a keyboard attached to it anyone (yes anyone) can reboot the system through it without login to the system. This might, or might not, adhere to your security policy. If you want to restrict this, you must check the /etc/inittab so that the line that includes ctrlaltdel calls shutdown with the -a switch (remember to run init q after making any changes to this file). The default in Debian includes this switch:
ca:12345:ctrlaltdel:/sbin/shutdown -t1 -a -r now
Now, in order to allow some users to shutdown the system, as the manpage shutdown(8) describes, you must create the file /etc/shutdown.allow and include there the name of users which can boot the system. When the three finger salute (a.k.a. ctrl+alt+del) is given the program will check if any of the users listed in the file are logged in. If none of them is, shutdown will not reboot the system.