Disabling Console Program Access; Disabling All Console Access; Defining The Console - Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Manual

184
jack
sophie
According to this example shutdown.allow file, stephen, jack, and sophie are allowed to shut-
down the system from the console using
shutdown -a in /etc/inittab checks to see if any of the users in /etc/shutdown.allow
(or root) are logged in on a virtual console. If one of them is, the shutdown of the system will continue;
if not, an error message will be written to the system console instead.
For more information on shutdown.allow see the shutdown man page.

17.2 Disabling Console Program Access

In order to disable access by users to console programs, you should run this command as root:
rm -f /etc/security/console.apps/*
In environments where the console is otherwise secured (BIOS and boot loader passwords are set,
[Ctrl]-[Alt]-[Delete]
want to allow any user at the console to run poweroff, halt, and reboot, which are accessible
from the console by default.
To remove these abilities, run the following commands as root:
rm -f /etc/security/console.apps/poweroff
rm -f /etc/security/console.apps/halt
rm -f /etc/security/console.apps/reboot

17.3 Disabling All Console Access

The PAM pam_console.so module manages console file permissions and authentication. (See
the Official Red Hat Linux Reference Guide for more information on configuring PAM.) If you want
to disable all console access, including program and file access, comment out all lines that refer to
pam_console.so in the /etc/pam.d directory. As root, the following script will do the trick:
cd /etc/pam.d
for i in * ; do
sed '/[^#].*pam_console.so/s/^/#/' < $i > foo && mv foo $i
done

17.4 Defining the Console

The pam_console.so module uses the /etc/security/console.perms file to determine
the permissions for users at the system console. The syntax of the file is very flexible; you can edit the
file so that these instructions no longer apply. However, the default file has a line that looks like this:
is disabled, the power and reset switches are disabled, and so forth), you may not
. When that key combination is used, the
[Ctrl]-[Alt]-[Del]
Chapter 17:Console Access