Red Hat Enterprise Linux 3: System Administration Guide
Prev |  | Next

# Chapter 30. Console Access

When normal (non-root) users log into a computer locally, they are given two types of special permissions:

1. They can run certain programs that they would not otherwise be able to run

2. They can access certain files (normally special device files used to access diskettes, CD-ROMs, and so on) that they would not otherwise be able to access

Since there are multiple consoles on a single computer and multiple users can be logged into the computer locally at the same time, one of the users has to "win" the race to access the files. The first user to log in at the console owns those files. Once the first user logs out, the next user who logs in owns the files.

In contrast, every user who logs in at the console is allowed to run programs that accomplish tasks normally restricted to the root user. If X is running, these actions can be included as menu items in a graphical user interface. As shipped, the console-accessible programs include `halt`, `poweroff`, and `reboot`.

# 30.1. Disabling Shutdown Via <KEYCAP >[Ctrl]</KEYCAP >-<KEYCAP >[Alt]</KEYCAP >-<KEYCAP >[Del]</KEYCAP >

By default, `/etc/inittab` specifies that your system is set to shutdown and reboot the system in response to a <KEYCAP >[Ctrl]</KEYCAP >-<KEYCAP >[Alt]</KEYCAP >-<KEYCAP >[Del]</KEYCAP > key combination used at the console. To completely disable this ability, comment out the following line in `/etc/inittab` by putting a hash mark (`#`) in front of it:

    ca::ctrlaltdel:/sbin/shutdown -t3 -r now

Alternatively, you may just want to allow certain non-root users the right to shutdown the system from the console using <KEYCAP >[Ctrl]</KEYCAP >-<KEYCAP >[Alt]</KEYCAP >-<KEYCAP >[Del]</KEYCAP >. You can restrict this privilege to certain users, by taking the following steps:

1. Add the `-a` option to the `/etc/inittab` line shown above, so that it reads:

       ca::ctrlaltdel:/sbin/shutdown -a -t3 -r now

   The `-a` flag tells `shutdown` to look for the `/etc/shutdown.allow` file.

2. Create a file named `shutdown.allow` in `/etc`. The `shutdown.allow` file should list the usernames of any users who are allowed to shutdown the system using <KEYCAP >[Ctrl]</KEYCAP >-<KEYCAP >[Alt]</KEYCAP >-<KEYCAP >[Del]</KEYCAP >. The format of the `/etc/shutdown.allow` file is a list of usernames, one per line, like the following:

       stephen
       jack
       sophie

According to this example `shutdown.allow` file, stephen, jack, and sophie are allowed to shutdown the system from the console using <KEYCAP >[Ctrl]</KEYCAP >-<KEYCAP >[Alt]</KEYCAP >-<KEYCAP >[Del]</KEYCAP >. When that key combination is used, the `shutdown -a` in `/etc/inittab` checks to see if any of the users in `/etc/shutdown.allow` (or root) are logged in on a virtual console. If one of them is, the shutdown of the system continues; if not, an error message is written to the system console instead.

For more information on `shutdown.allow` see the `shutdown` man page.

Prev | Home | Next
System Configuration | Up | Disabling Console Program Access