UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

RHEL 9 must disable the ability of a user to restart the system from the login screen.


Overview

Finding ID Version Rule ID IA Controls Severity
V-258029 RHEL-09-271095 SV-258029r991589_rule Medium
Description
A user who is at the console can reboot the system at the login screen. If restart or shutdown buttons are pressed at the login screen, this can create the risk of short-term loss of availability of systems due to reboot.
STIG Date
Red Hat Enterprise Linux 9 Security Technical Implementation Guide 2024-06-04

Details

Check Text ( C-61770r926072_chk )
Verify RHEL 9 disables a user's ability to restart the system with the following command:

Note: This requirement assumes the use of the RHEL 9 default graphical user interface, Gnome Shell. If the system does not have any graphical user interface installed, this requirement is Not Applicable.

$ grep -R disable-restart-buttons /etc/dconf/db/*

/etc/dconf/db/distro.d/20-authselect:disable-restart-buttons='true'

If the "disable-restart-button" setting is not set to "true", is missing or commented out from the dconf database files, this is a finding.
Fix Text (F-61694r943058_fix)
Configure RHEL 9 to disable a user's ability to restart the system.

Add or update the [org/gnome/settings-daemon/] section of the /etc/dconf/db/local.d/00-security-settings" database file and add or update the following lines:

[org/gnome/login-screen]
disable-restart-buttons='true'

Then update the dconf system databases:

$ sudo dconf update