← Rules Catalog
lowsystemverified

Ensure graphical target is not the default

no-graphical-target · RHEL ≥ 8 · 1 impl

Description

The system's default systemd target should not be graphical.target on servers. Server systems should boot to multi-user.target to reduce attack surface and resource usage.

Rationale

Running a graphical user interface on servers increases the attack surface by loading display managers, X servers, and desktop services. These provide additional potential vulnerabilities without benefit on headless systems.

Check → Remediate

Checksystemd_target
not_expected:
graphical.target
Remediatecommand_exec
systemctl set-default multi-user.target

Framework references

STIG

V-257781 / RHEL-09-211030V-251718

NIST 800-53

CM-7

Live verification

rhel8:check
#systemd#target#gui#attack-surface