documentation_complete: true

prodtype: rhel7,fedora

title: 'Disable Ctrl-Alt-Del Reboot Activation'

description: |-
    By default, <tt>SystemD</tt> will reboot the system if the <tt>Ctrl-Alt-Del</tt>
    key sequence is pressed.
    <br /><br />
    To configure the system to ignore the <tt>Ctrl-Alt-Del</tt> key sequence from the
    command line instead of rebooting the system, do either of the following:
    <pre>ln -sf /dev/null /etc/systemd/system/ctrl-alt-del.target</pre>
    or
    <pre>systemctl mask ctrl-alt-del.target</pre>
    <br /><br />
    Do not simply delete the <tt>/usr/lib/systemd/system/ctrl-alt-del.service</tt> file,
    as this file may be restored during future system updates.

rationale: |-
    A locally logged-in user who presses Ctrl-Alt-Del, when at the console,
    can reboot the system. If accidentally pressed, as could happen in
    the case of mixed OS environment, this can create the risk of short-term
    loss of availability of systems due to unintentional reboot.

severity: high

identifiers:
    cce@rhel7: 27511-5

references:
    cui: 3.4.5
    disa: 366
    hipaa: 164.308(a)(1)(ii)(B),164.308(a)(7)(i),164.308(a)(7)(ii)(A),164.310(a)(1),164.310(a)(2)(i),164.310(a)(2)(ii),164.310(a)(2)(iii),164.310(b),164.310(c),164.310(d)(1),164.310(d)(2)(iii)
    nist: AC-6
    srg: SRG-OS-000480-GPOS-00227
    stigid@rhel7: "020230"

ocil_clause: 'the system is configured to reboot when Ctrl-Alt-Del is pressed'

ocil: |-
    To ensure the system is configured to mask the Ctrl-Alt-Del sequence,
    enter the following command:
    <pre>$ sudo ln -sf /dev/null /etc/systemd/system/ctrl-alt-del.target</pre>
    or
    <pre>$ sudo systemctl mask ctrl-alt-del.target</pre>
