Configuring Systemd-Logind to Secure Virtual Consoles on Multi-User Desktop Nodes

핵심 내용

1. Disable unused virtual consoles. Reduce the number of getty instances to limit attack surface.
2. Configure console switching. Restrict Ctrl+Alt+Fx switching to prevent unauthorized console access.
3. Set idle session timeouts. Automatically lock sessions that have been idle too long.
4. Manage seat assignment. Ensure each user gets a dedicated seat with isolated devices.
5. Enable session tracking. Logind tracks sessions for audit and policy enforcement.
6. Configure polkit rules. Restrict who can reboot, suspend, or change system settings.
7. Protect the graphical session. Ensure the display manager starts on a dedicated VT.
8. Audit sessions. Use loginctl to review active sessions and seats.

Architecture

Logind manages seats, sessions, and virtual consoles. Each physical console maps to a seat, and sessions are tracked per user. Console switching is mediated by logind, which can restrict or disable it. Polkit provides additional authorization.

Production configuration

# /etc/systemd/logind.conf
[Login]
NAutoVTs=2
ReserveVT=1
KillUserProcesses=yes
IdleAction=lock
IdleActionSec=300
HandlePowerKey=poweroff
HandleSuspendKey=suspend
HandleLidSwitch=suspend

systemctl disable getty@tty3.service
systemctl disable getty@tty4.service
systemctl disable getty@tty5.service
systemctl disable getty@tty6.service
systemctl daemon-reload

loginctl show-seat seat0 -p VTNr

polkit.addRule(function(action, subject) {
  if (action.id == "org.freedesktop.login1.set-wall-message" &&
      subject.isInGroup("admins")) {
    return polkit.Result.YES;
  }
  return polkit.Result.NOT_HANDLED;
});

Edge cases from production

• Disabling all VTs breaks emergency recovery; keep at least one reserved.
• IdleAction=lock requires a screen locker; ensure one is installed and configured.
• Some applications expect VT switching; test before restricting.
• Logind changes require a daemon restart or reboot to take full effect.

자주 묻는 질문