Assume I start an X server manually from a virtual console /dev/tty1 with xinit or startx, with the line id:3:initdefault: set in /etc/inittab. The X server gets run and put on another virtual console, normally being /dev/tty7. After some time I decide to lock the screen with xscreensaver --lock and leave my computer. To unlock the screen one would have to know my user's password. If someone now decides to kill the running X server, he or she would be returned to the shell running at /dev/tty1 and pretty much have access to my computer. Typically, the X server can be killed with Ctrl+Alt+Backspace or switching to the initial console and SIGTERM the running process with ^C.

This is trivial to do - which means there must be trivial ways to prevent it from happening. I'm using vlock to lock my virtual console /dev/tty1 to prevent this:

$ xinit && vlock || vlock

When the X server now returns, gracefully && or not ||, the console will be locked. This may not be the optimal solution. I've read this thread and this wiki article, explaining different solutions.

What other methods are there to prevent this kind of access to virtual consoles from X sessions? Is the above method safe enough? How do you prevent this on your system? I'm not going to use a display manager.

  • 2
    I just use startx & vlock. && and || wait for the previous process to terminate (possible race condition with keyboard interrupt Ctrl-c). You should also remember that physical access is game over as far as security goes, as anyone could pop in a tiny surreptitious keylogger or do any number of other things while you are away. I generally take the position of either giving up on security/trusting everyone who has physical access to my computer OR physically securing my computer (e.g. by keeping it with me) if I actually need my computer secured. – jw013 Jun 14 '12 at 1:27
  • Have you considered vlock -na? That blocks the entire "console display" (-a), so you can't switch to other VTs. -n creates a new VT for vlock, making it possible to use it from X. With this, you'd run vlock -na instead of xscreensaver --lock. – njsg Apr 20 '13 at 12:33

You can prevent console switches from Xorg by adding the Option "DontVTSwitch" "yes" to your Xorg config file.

To prevent Ctrl+Alt+Backspace you have to add the DontZap option to your Xorg config file. Of course this will not completely prevent access to the console. If X terminates for some reason, e.g. problem with a driver the attacker will still have access to your console.

You can also use exec startx instead of startx which will replaces bash with startx, this means even if someone is able to abort X they won't be able to access your console. You can also use a display manager like lightdm, kdm, gdm, or xdm so you won't need an existing shell session to start a x session.


I have the following entry in my .profile:

# startx if on tty1 and tmux on tty2
if [[ -z "$DISPLAY" ]] && [[ $(tty) = /dev/tty1 ]]; then
    exec xinit -- :0 -novtswitch &>/dev/null &

  elif [[ $(tty) = /dev/tty2 ]]; then
    tmux -f $HOME/.tmux/conf new -s secured

If I choose to log into X, I use TTY1. The logout ensures that, after X is started on TTY7, I am logged out of TTY1. I use xautolock and slock as my screen locking tools.

If X is killed, I am dumped back to an empty TTY7 and then have to switch to one of six active gettys to log back in.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy