3

I'm trying to update some of my Puppet manifests that disable CAD on RHEL machines.

Right now I'm doing it the over the top way on systemd: masking (ie. linking to /dev/null)

$ctrlaltdel_process = '/usr/bin/logger -p security.info "Control-Alt-Delete pressed"'

  # Every version of RHEL has a different way of doing this! :)
  case $::operatingsystemmajrelease {
    '4','5': {
      augeas { 'disable-inittab-ctrlaltdel':
        context => '/files/etc/inittab',
        lens    => 'inittab.lns',
        incl    => '/etc/inittab',
        changes => "set *[action = 'ctrlaltdel']/process '${ctrlaltdelprocess}'",
      }
    }
    '6': {
      file { '/etc/init/control-alt-delete.conf':
        ensure  => file,
        content => $ctrlaltdel_process,
      }
    }
    '7': {
      file { '/etc/systemd/system/ctrl-alt-del.target':
        ensure => 'link',
        target => '/dev/null',
      }
    }
    default: {
      fail("Module ${module_name} is not supported on this ${::operatingsystemmajrelease}")
    }
  }

As you can see, on other systems I'm actually writing a security log saying that CAD was pressed, but I wouldn't get this with systemd machines.

I like the idea of actually having the trap in the logs so we can trace if people are doing it.

Can someone give me an example systemd config file for ctrl+alt+delete that would do the same thing?

2
# ctrl-alt-del.target
[Unit]
DefaultDependencies=no  # Do not affect the system through dependencies
Requires=ctrl-alt-del.service
StopWhenUneeded=yes

# ctrl-alt-del.service
[Service]
DefaultDependencies=no  # Do not affect the system through dependencies
Type=oneshot
ExecStart=/usr/bin/logger -p security.info "Control-Alt-Delete pressed"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.