0

My goal is to configure a "closed/black box" Linux in which systemd is used, but it is simply impossible to have any sort of interactive login.

I'm not talking abut just switching off certain config options to turn off interactive login, I'm wanting to know if there is a way to make the system simply impossible to log in to under any circumstances because there is not software on the machine that allows login.

Is that possible?

2

As a StackExchange question and with as little detail as this has: no. It is most likely not possible to do that as a configuration step.

There are a small number of critical links you could remove, but not cleanly.

Generally you don't remove all interactive shell interpreters, because you need one to run shell scripts. The systemd project aims to boot without them, and it enables a lot of system software to do so as well, but it's still hard to say that you'll never want to run a shell script. E.g. rpm and dpkg use shell to run package install actions.

login (and sulogin) are part of a single package called util-linux. Generally you don't remove this package. For example util-linux is also the package that provides the mount program, which is a dependency of systemd PID 1. So you would have to break (remove) parts of an installed package. This is usually avoided, for example that damage will be repaired if you ever upgrade the package, it will show up as warnings if you ever want to verify package checksums, etc.

By these definitions, you would have to remove systemd/system/debug-shell.service as well. This file also, is not a configuration file that is designed to be modified or removed, and it is part of the systemd package.

Not running the software that allows login would be the standard way to achieve this. It is fairly clean and effective. Another standard technique is not to create any user with an unlocked password and (or) valid login shell. If I was feeling paranoid I would do the latter. (And the former would naturally follow, for cleanliness and reducing "attack surface", as much as for redundancy).

2
  • 1
    The problem with convincing people that no software exists on a machine that could provide the capability to gain an interactive shell on a terminal is that, given /bin/sh, systemd on its own can provide such a capability, by dint of a service unit that attaches to a terminal and then ExecStart=/bin/sh. – JdeBP Oct 1 '18 at 23:20
  • @JdeBP I would boil down the hypothetical case to sh </dev/ttyN >/dev/ttyN 2>&1. But it's a good point considering that debug-shell.service exists. – sourcejedi Oct 2 '18 at 7:56
0

You can disable the getty services getty@.service. You can disable sshd. You can disable other services that you have that might provide logins.

You can set the password field of every user in /etc/shadow to *, so that there is no valid password even if there is a service that allows logins.

2
  • 2
    As mentioned in the question, I'm interested in knowing not so much how to disable login, but to completely make login impossible because the required software to login is not on the system. – Duke Dougal Oct 1 '18 at 21:22
  • 2
    You can remove sshd. You can also remove getty. – RalfFriedl Oct 1 '18 at 21:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.