I was reading a post that was submitted previously here, http://www.linuxquestions.org/questi...ing+the+system

and had more questions about this possibly happening and wondered if i can get some input. I have several RHEL4 servers that i want to make sure that non root users cant issue any init commands or shutdown commands or be able to ctrl+alt+backspace. I want only root and users in sudoers to be able to do this.

So to make sure that this can only be done with root or users in sudoers, will doing the following accomplish this?

changing /etc/inittab entry ca::ctrlaltdel:/sbin/shutdown -t3 -r now
to
ca::ctrlaltdel:ech0 Reboot/Shutdown is not possible at this time.

chmod /sbin/shutdown to 750

chmod /usr/bin/apmsleep to 750

removing everything in /etc/security/console.apps/

If there is any other steps that can be taken to prevent this, im all ears. Thanks in advance!

Hi,

Non Root users should not be able to issue init commands anyway. If they have physical access to the server then they can press CTRL+ATL+DEL you can edit /etc/inittab and comment out.
ca::ctrlaltdel:/sbin/shutdown -t3 -r now
so it should be
#ca::ctrlaltdel:/sbin/shutdown -t3 -r now

However if they have phyiscal access then there's nothing stopping them pressing the power button or removing the power cable.
Worst still is they can boot the server into single user mode as well and do what ever they like, unless you have a BIOS password and grub password.

They dont have physical access so i was concerned mainly about command line commands that they could type like init 0, 1, 6 or shutdown commands. Is this a posibility or should the precautions i asked about earlier be taken?

Those commands can only be run by root. Check your kdm configuration to disable kdm from rebooting (if they log in that way).

Another possible loophole is PolicyKit, but rebooting should be disabled for remote users. You can read through the policies on your server to make sure.

Look in the Users & Security sections of your configuration settings program for RH. That is usually where you can easily change reboot settings. Not using RHEL myself, I can't be certain.

Check the sudoers configuration. Some allow all local users permission to run the shutdown command without a root password.

You may also want to log in remotely as a regular user and see if you can do it. ( Maybe do this real late at night, and if you can run shutdown, rerun it the the -c (cancel) option. )