Disable reboot with Ctrl-Alt-Del on the console

Description

systemd reboots the system when Ctrl-Alt-Del is pressed on a text console, through ctrl-alt-del.target. Masking that target turns the key combination into a no-op.

Desktops handle the key combination in the graphical session; see the desktop controls.

Rationale

On a server, a reboot should always be a deliberate, authenticated action. The key combination is reachable without logging in from a physical keyboard, a KVM switch or a hypervisor console, sometimes by accident.

Impact

Ctrl-Alt-Del no longer reboots the system from a text console. Administrators reboot with systemctl reboot.

Audit

Run systemctl is-enabled ctrl-alt-del.target. It must print masked.

Automated: every check must pass. Scanners report each check by its id.

masked

unit: ctrl-alt-del.target
state: masked

Remediation

Run systemctl mask ctrl-alt-del.target and systemctl daemon-reload.

Rollback

Run systemctl unmask ctrl-alt-del.target.

mask

Generated from check masked: the engine writes the fix for every output, it sets the expected value and the check runs again after.

Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• systemd.special(7), Debian manual pages (ctrl-alt-del.target) Debian, vendor-doc, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle