3

I enable the serial console during the boot process on centos7 which uses grub2 and systemd (instead of inittab)

I would like to undo that serial input/output at the very end of the boot, after a completely successful start, for security reasons.

How can I accomplish this?

Update:

I discovered by going through systemd services that the console is recognized/enabled through it even though grub2 started it, so this turns it off, I think.

systemctl stop [email protected]

How can I make that happen automatically after a completely successful start where all other services have come online. I could use rc.local but that is init.d legacy and doesn't take into account that other services have come online properly.

1
  • 3
    Are you sure you want to do this? You may need that serial login sooner or later. And if you are thinking about "security" you'd be better served by not allowing tourists in your server room. Dec 20, 2014 at 14:35

2 Answers 2

3

This feels awfully hacky, but it does the job. It will stop the serial terminal after the machine has been booted.

/etc/systemd/system/killconsole.service:

[Unit]
Description=kill console after boot
After=default.target

[Service]
Type=simple
ExecStart=/bin/systemctl stop [email protected]

[Install]
WantedBy=default.target

Then simply run systemctl enable /etc/systemd/system/killconsole.service to enable the unit.

You could also trigger the above using a separate timer unit that wouldn't fire until X minutes after boot. If you give that a try, be sure to rip out the Install section from the service and run a systemctl disable on it to remove it from default.target's wants list.

Note that the definition of 'successful boot' may vary. For example, if the box's network is hosed, all of the services may start up fine but you might still need serial access. As such, I'd highly recommend creating a small script to ensure that the system is alive and well (and on the network) and placing it in an ExecStartPre option. If the Pre script returns a failed exit code, then the service won't be run and the serial console won't be disabled.

1
  • So I take it default.target is the very last target that loads after network, etc. The execstartpre is a very good idea too, thanks!
    – ck_
    Dec 22, 2014 at 13:03
1

This can be achieved my masking that service:

systemctl mask [email protected]

Kudos to this answer.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .