The x86 Ctrl-Alt-Delete key sequence must be disabled.

From Red Hat Enterprise Linux 7 Security Technical Implementation Guide

Associated with: CCI-000366

SV-86617r1_rule The x86 Ctrl-Alt-Delete key sequence must be disabled.

Vulnerability discussion

A locally logged-on user who presses Ctrl-Alt-Delete, when at the console, can reboot the system. If accidentally pressed, as could happen in the case of a mixed OS environment, this can create the risk of short-term loss of availability of systems due to unintentional reboot. In the GNOME graphical environment, risk of unintentional reboot from the Ctrl-Alt-Delete sequence is reduced because the user will be prompted before any action is taken.

Check content

Verify the operating system is not configured to reboot the system when Ctrl-Alt-Delete is pressed. Check that the ctrl-alt-del.service is not active with the following command: # systemctl status ctrl-alt-del.service reboot.target - Reboot Loaded: loaded (/usr/lib/systemd/system/reboot.target; disabled) Active: inactive (dead) Docs: man:systemd.special(7) If the ctrl-alt-del.service is active, this is a finding.

Fix text

Configure the system to disable the Ctrl-Alt_Delete sequence for the command line with the following command: # systemctl mask ctrl-alt-del.target If GNOME is active on the system, create a database to contain the system-wide setting (if it does not already exist) with the following command: # cat /etc/dconf/db/local.d/00-disable-CAD Add the setting to disable the Ctrl-Alt_Delete sequence for GNOME: [org/gnome/settings-daemon/plugins/media-keys] logout=’’

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.