One way to do this is to specify that your service is started before another service, by using Before=
. In this case, because there is no GUI, and you want to prevent console logins, you'll need to use [email protected]
. (Note, however, that that's a parametrized service, and, in this case, the part after the @
represents what device to run getty
on). For example:
[Unit]
Description=Run script to set up environment
[email protected] [email protected] [email protected] [email protected] [email protected] [email protected]
[Service]
Type=oneshot
ExecStart=/bin/myscript
This will make sure that your script runs before getty
starts on TTY 1-6.
Alternatively, you can instead create an (empty) file that will tell [email protected]
not to start up. This has the advantage that it will automatically add the condition to all instances of getty
, and not just 1-6.
To do that, first create the file before your service starts:
[Unit]
Description=Run script to set up environment
[Service]
Type=oneshot
ExecStartPre=/bin/touch /etc/no-login-console
ExecStart=/bin/myscript
ExecStopPost=/bin/rm /etc/no-login-console
Then, run systemctl edit [email protected]
. This will open your editor and create an "override" file, which will effectively be appended to the main service file. That way, you can make your own customizations to the service, but still be able to use the latest versions of the service file form CentOS. In the editor that opens up, enter:
[Unit]
ConditionPathExists=!/etc/no-login-console
This tells the service to start only if /etc/no-login-console
doesn't exist. Save and exit the editor. When you run systemctl cat [email protected]
, you should see the main service file, followed by your override.
Edit: It looks like systemctl edit
and systemctl cat
isn't available in the version of systemd
shipped in CentOS 7.1. Instead, run sudo vim /lib/systemd/system/[email protected]/condition-path.conf
(where /lib/systemd/system/[email protected]
is the path to the service file) and add the above text into the file. Then, run systemctl daemon-reload
followed by systemctl status getty@
. The output should indicate that a drop-in file was read.
graphical.target
, which starts aftermulti-user.target
, so having your unit file install tomulti-user.target
along withBefore=graphical.target
might work.Conflicts=display-manager.service
? (check to see that there is a service aliased todisplay-manager.service
; otherwise, use the service that starts your graphical environment). This will make sure that while the script is running, the login screen (or rather, the GUI) isn't active. That being said, if, while the script is running, I saysystemctl start display-manager.service
, then the script will be killed, so you might need to play with theBefore=
andAfter=
settings.ExecStartPre=
create a file called/etc/no-login-screen
(don't use/etc/nologin
; seeman pam_nologin
) and then edit the login screen's unit file to addConditionPathExists=! /etc/no-login-screen
, so that the login screen doesn't start up if that file exists.