[PATCH 4/6] added Rule text for disabling Ctrl-Alt-Del reboots

Jeffrey Blank blank at eclipse.ncsc.mil
Sun Oct 21 19:57:42 UTC 2012


Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
 RHEL6/input/system/accounts/physical.xml |   29 +++++++++++++++++++++++++++++
 1 files changed, 29 insertions(+), 0 deletions(-)

diff --git a/RHEL6/input/system/accounts/physical.xml b/RHEL6/input/system/accounts/physical.xml
index a72921d..b331bbb 100644
--- a/RHEL6/input/system/accounts/physical.xml
+++ b/RHEL6/input/system/accounts/physical.xml
@@ -130,6 +130,35 @@ by configuring the bootloader password.
 <ref nist="AC-6, IA-5" disa="213" />
 </Rule>
 
+<Rule id="disable_ctrlaltdel_reboot">
+<title>Disable Ctrl-Alt-Del Reboot Activation</title>
+<description>
+By default, the system includes the following line in
+<tt>/etc/init/control-alt-delete</tt>
+to reboot the system when the Ctrl-Alt-Del key sequence is pressed:
+<pre>exec /sbin/shutdown -r now "Control-Alt-Delete pressed"</pre>
+<br/>
+To configure the system to log a message instead of
+rebooting the system, alter that line to read as follows:
+<pre>exec /usr/bin/logger -p security.info "Control-Alt-Delete pressed"</pre>
+</description>
+<ocil clause="the system is configured to run the shutdown command">
+To check how the system is configured to behave when Ctrl-Alt-Del is pressed,
+inspect the file <tt>/etc/init/control-alt-delete</tt>.
+The commands following the line:
+<pre>start on control-alt-delete</pre>
+will be executed when the key sequence is pressed.
+</ocil>
+<rationale>
+A locally logged-in user who presses Ctrl-Alt-Del, when at the console,
+can reboot the system. If accidentally pressed, as could happen in
+the case of mixed OS environment, this can create the risk of short-term
+loss of availability systems due to unintentional reboot.
+In the GNOME graphical environment, risk of unintentional reboot from the
+Ctrl-Alt-Del sequence is reduced because the user will be
+prompted before any action is taken.
+</rationale>
+</Rule>
 
 <Rule id="disable_interactive_boot">
 <title>Disable Interactive Boot</title>
-- 
1.7.1



More information about the scap-security-guide mailing list