← Back to Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide

V-269279

CAT II (Medium)

AlmaLinux OS 9 must disable the ability of a user to restart the system from the login screen.

Rule ID

SV-269279r1050161_rule

STIG

Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide

Version

V1R6

CCIs

CCI-000366

Discussion

A user who is at the console can reboot the system at the login screen. If restart or shutdown buttons are pressed at the login screen, this can create the risk of short-term loss of availability of systems due to reboot.

Check Content

Note: This requirement assumes the use of the AlmaLinux OS 9 default graphical user interface, Gnome Shell. If the system does not have any graphical user interface installed, this requirement is Not Applicable.

Verify AlmaLinux OS 9 disables a user's ability to restart the system with the following command:

$ grep -R disable-restart-buttons /etc/dconf/db/*

/etc/dconf/db/distro.d/20-authselect:disable-restart-buttons='true'

If the "disable-restart-button" setting is not set to "true", is missing or commented out from the dconf database files, this is a finding.

Fix Text

Configure AlmaLinux OS 9 to disable a user's ability to restart the system.

Add or update the [org/gnome/settings-daemon/] section of the /etc/dconf/db/local.d/00-security-settings" database file and add or update the following lines:

[org/gnome/login-screen]
disable-restart-buttons=true

Then update the dconf system databases:

$ dconf update