Description
systemd reboots the system when Ctrl-Alt-Del is pressed on a text console, through
ctrl-alt-del.target. Masking that target turns the key combination into a no-op.
Desktops handle the key combination in the graphical session; see the desktop controls.
Rationale
On a server, a reboot should always be a deliberate, authenticated action. The key combination is reachable without logging in from a physical keyboard, a KVM switch or a hypervisor console, sometimes by accident.
Impact
Ctrl-Alt-Del no longer reboots the system from a text console. Administrators reboot with
systemctl reboot.
Audit
Run systemctl is-enabled ctrl-alt-del.target. It must print masked.
Automated: every check must pass. Scanners report each check by its id.
masked
unit: ctrl-alt-del.target
state: masked
Remediation
Run systemctl mask ctrl-alt-del.target and systemctl daemon-reload.
| Restart | none |
| Disruption | none |
Rollback
Run systemctl unmask ctrl-alt-del.target.
mask
Generated from check masked: the engine writes the fix for every output, it sets the expected value and the check runs again after.
Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.
References
- systemd.special(7), Ubuntu manual pages (ctrl-alt-del.target) Canonical, vendor-doc, accessed 2026-10-19
Mappings
| Framework | ID | Relation |
|---|---|---|
| NIST SP 800-53 Rev. 55.1.1 | CM-6 | related |
How this control relates to the other framework's: equivalent, stricter, looser, partial or related.
Threats mitigated
| Taxonomy | ID |
|---|---|
| MITRE ATT&CK | T1529 |
People and lifecycle
| Authors |
|
| Verified | 2026-10-19 by Sn0wAlice on 20.04, Proxmox VM, Ubuntu 20.04 cloud image, kernel 5.4.0-216-generic. Fails on a fresh install; generated fix masks the target, check again and second fix idempotent; profile server-hardened, not rebooted after this fix. |
| Verified | 2026-10-19 by Sn0wAlice on 22.04, Proxmox VM, Ubuntu 22.04 cloud image, kernel 5.15.0-198-generic. Fails on a fresh install; generated fix masks the target, check again and second fix idempotent; profile server-hardened, not rebooted after this fix. |
| Verified | 2026-10-19 by Sn0wAlice on 24.04, Proxmox VM, Ubuntu 24.04 cloud image, kernel 6.8.0-147-generic. Fails on a fresh install; generated fix masks the target, check again and second fix idempotent; profile server-hardened, not rebooted after this fix. |
| Verified | 2026-10-19 by Sn0wAlice on 26.04, Proxmox VM, Ubuntu 26.04 cloud image, kernel 7.0.0-38-generic. Fails on a fresh install; generated fix masks the target, check again and second fix idempotent; profile server-hardened, not rebooted after this fix. |
| Introduced in | v0.1.0 |
| Created, updated | 2026-10-19, 2026-10-19 |
| Translations | fr |
