Configuring Systemd-Logind to Secure Virtual Consoles on Multi-User Desktop Nodes

Kernpunkte

• Disable unused virtual consoles. Reduce the number of getty instances to limit attack surface.
• Configure console switching. Restrict Ctrl+Alt+Fx switching to prevent unauthorized console access.
• Set idle session timeouts. Automatically lock sessions that have been idle too long.
• Manage seat assignment. Ensure each user gets a dedicated seat with isolated devices.
• Enable session tracking. Logind tracks sessions for audit and policy enforcement.
• Configure polkit rules. Restrict who can reboot, suspend, or change system settings.
• Protect the graphical session. Ensure the display manager starts on a dedicated VT.
• Audit sessions. Use loginctl to review active sessions and seats.

Architecture

Logind manages seats, sessions, and virtual consoles. Each physical console maps to a seat, and sessions are tracked per user. Console switching is mediated by logind, which can restrict or disable it. Polkit provides additional authorization.

Production configuration

# /etc/systemd/logind.conf
[Login]
NAutoVTs=2
ReserveVT=1
KillUserProcesses=yes
IdleAction=lock
IdleActionSec=300
HandlePowerKey=poweroff
HandleSuspendKey=suspend
HandleLidSwitch=suspend

systemctl disable getty@tty3.service
systemctl disable getty@tty4.service
systemctl disable getty@tty5.service
systemctl disable getty@tty6.service
systemctl daemon-reload

loginctl show-seat seat0 -p VTNr

polkit.addRule(function(action, subject) {
  if (action.id == "org.freedesktop.login1.set-wall-message" &&
      subject.isInGroup("admins")) {
    return polkit.Result.YES;
  }
  return polkit.Result.NOT_HANDLED;
});

Edge cases from production

• Disabling all VTs breaks emergency recovery; keep at least one reserved.
• IdleAction=lock requires a screen locker; ensure one is installed and configured.
• Some applications expect VT switching; test before restricting.
• Logind changes require a daemon restart or reboot to take full effect.

Häufige Fragen