I am testing Linux configuration security checking tools recently and I downloaded a tool called lynis. One thing it checks is the default runlevel. However, even after reading some info about runlevel, I still don't understand why checking runlevel is relevant to security.

I read the following source: Configuring Linux Services and Runlevels.

What can go wrong if I configure the runlevel wrong? And which level could be undesirable?

1 Answer 1


Runlevels determine what services are started on Unix machines. Usually the higher the level, the more distinct processes are executed. As a general rule level 3 does not include GUI and level 5 does.

There is no right or wrong runlevel. It's about compliance.

The problem might arise when you secure your server assuming it's running without a graphical environment (thus for example you don't harden or patch it), but in reality it does (so the attack surface is larger than you assumed).

The checks are there to make sure the machine is running at the level you expect it to run; and that it runs (only) services you expect it to run at the specified level.

And which level could be undesirable?

Any level different from the policy specified for each individual server is undesirable.

What can go wrong if I configure the runlevel wrong?

In such case you cannot claim you have a full control over your systems. You don't know what processes they are running, you can't tell if those processes are secure. You can't tell what can go wrong.

  • I dunno, I think a default runlevel of 6 is pretty objectively wrong. Unless you're doing it as a prank.
    – forest
    Mar 29, 2018 at 6:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .