← Rules Catalog
highservicesverified rollback-safe

Disable debug-shell service

service-disable-debug-shell · RHEL ≥ 8 · 1 impl

Description

The debug-shell service provides a root shell on tty9 during boot for debugging purposes. It should be disabled in production.

Rationale

The debug-shell provides unauthenticated root access during boot, which could be exploited by attackers with physical access to gain complete control of the system.

Check → Remediate

Checkservice_state
name:
debug-shell
active:
false
enabled:
false
Remediateservice_masked
name:
debug-shell

Framework references

STIG

V-230532V-257786 / RHEL-09-211055V-280094 / RHEL-10-700970

NIST 800-53

AC-3IA-2CM-7

Live verification

rhel10:checkrhel8:checkrhel9:check
#service#debug#console#physical-security#stig