highservicesverified ✓rollback-safe
Disable debug-shell service
service-disable-debug-shell · RHEL ≥ 8 · 1 impl
Description
The debug-shell service provides a root shell on tty9 during boot for debugging purposes. It should be disabled in production.
Rationale
The debug-shell provides unauthenticated root access during boot, which could be exploited by attackers with physical access to gain complete control of the system.
Check → Remediate
Checkservice_state
- name:
- debug-shell
- active:
- false
- enabled:
- false
Remediateservice_masked
- name:
- debug-shell
Framework references
STIG
V-230532V-257786 / RHEL-09-211055V-280094 / RHEL-10-700970
NIST 800-53
AC-3IA-2CM-7
Live verification
rhel10:checkrhel8:checkrhel9:check
#service#debug#console#physical-security#stig