A.P. Lawrence

2005/03/10 shutdown.allowed

On some systems, inittab contains a line that looks like this:

ca::ctrlaltdel:/sbin/shutdown -t3 -r now

That lets someone at the physical console reboot using only ctrl-alt-delete. No one even has to be logged in; physical access to the keyboard is all you need.

Modifying that line to add a -a

ca::ctrlaltdel:/sbin/shutdown -a -t3 -r now

changes the behavior. Now, someone has to be logged in and they have to be listed in /etc/shutdown.allow (one user per line).

If /etc/shutdown.allow doesn't exist, the -a does you no good - the machine will still reboot. However, even an empty shutdown.allow will prevent reboot - unless root is logged in (su - doesn't cut it; root must be logged in). There's no point in preventing root, as they could run shutdown directly anyway. If no one is logged in, ctrl-alt-delete won't work. If a user (other than root) is logged in, they have to be listed ion /etc/shutdown.allow.

It's interesting that "halt" is in /etc/pam.d but shutdown is not.

Psst - Wanna work for yourself?

Comments


Add your comments

Why no "Digg this!" etc.?

Phone and Email Support at Monthly rates

Enter your email address for automatic notification of new posts here
(be sure to whitelist 'feedburner.com' if you use spam filtering)

Have you tried Searching this site?

Unix/Linux/Mac OS X support by phone, email or on-site: Support Rates

This is a Unix/Linux resource website. It contains technical articles about Unix, Linux and general computing related subjects, opinion, news, help files, how-to's, tutorials and more. We appreciate comments and article submissions.

Publishing your articles here