documentation_complete: true


title: 'Disable Graphical Environment Startup By Setting Default Target'

description: |-
    Systems that do not require a graphical user interface should only boot by
    default into <tt>multi-user.target</tt> mode. This prevents accidental booting of the system
    into a <tt>graphical.target</tt> mode. Setting the system's default target to
    <tt>multi-user.target</tt> will prevent automatic startup of the graphical environment.
    To do so, run:
    <pre>$ systemctl set-default multi-user.target</pre>
    You should see the following output:
    <pre>Removed symlink /etc/systemd/system/default.target.
    Created symlink from /etc/systemd/system/default.target to /usr/lib/systemd/system/multi-user.target.</pre>

rationale: |-
    Services that are not required for system and application processes
    must not be active to decrease the attack surface of the system.

severity: medium

identifiers:
    cce@rhel8: CCE-83380-6
    cce@rhel9: CCE-84105-6
    cce@rhel10: CCE-89266-1

references:
    cis-csc: 12,15,8
    cobit5: APO13.01,DSS01.04,DSS05.02,DSS05.03
    isa-62443-2009: 4.3.3.6.6
    isa-62443-2013: 'SR 1.13,SR 2.6,SR 3.1,SR 3.5,SR 3.8,SR 4.1,SR 4.3,SR 5.1,SR 5.2,SR 5.3,SR 7.1,SR 7.6'
    iso27001-2013: A.11.2.6,A.13.1.1,A.13.2.1,A.14.1.3,A.6.2.1,A.6.2.2
    nist: CM-7(a),CM-7(b),CM-6(a)
    nist-csf: PR.AC-3,PR.PT-4
    srg: SRG-OS-000480-GPOS-00227
    stigid@ol8: OL08-00-040321

ocil_clause: 'the system default target is not set to "multi-user.target" and the Information System Security Officer (ISSO) lacks a documented requirement for a graphical user interface'

ocil: |-
    Verify that {{{ full_name }}} is configured to boot to the command line:
    <pre>$ systemctl get-default</pre>
    <pre>multi-user.target</pre>

fixtext: |-
    Document the requirement for a graphical user interface with the ISSO or set the default target to multi-user with the following command:

    $ sudo systemctl set-default multi-user.target

srg_requirement: 'The graphical display manager must not be the default target on {{{ full_name }}} unless approved.'

platform: system_with_kernel
