highsystemverified ✓rollback-safe

Disable the Ctrl-Alt-Delete burst key sequence

ctrl-alt-del-burst-disabled · RHEL ≥ 8 · 1 impl

Description

RHEL 8 must disable the systemd CtrlAltDelBurstAction so that rapidly pressing Ctrl-Alt-Delete cannot trigger an unplanned reboot.

Rationale

A user accidentally or maliciously triggering the Ctrl-Alt-Delete burst sequence could reboot the system, causing a denial of service.

Check → Remediate

Checkcommand

val=$(systemd-analyze cat-config systemd/system.conf 2>/dev/null |
  grep -E '^CtrlAltDelBurstAction=' | tail -1)
[ "$val" = "CtrlAltDelBurstAction=none" ]

expected_exit:: 0

Remediateconfig_set_dropin

dir:: /etc/systemd/system.conf.d
file:: 00-kensa-cad-burst.conf
key:: CtrlAltDelBurstAction
value:: none
section:: [Manager]

Framework references

STIG

V-281298 / RHEL-10-700950V-230531 / RHEL-08-040172

NIST 800-53

CM-6

Live verification

rhel8:check

#systemd#ctrl-alt-del#availability