Prevent Accidental Reboots in Debian with molly-guard

Managing multiple remote servers simultaneously creates a significant risk of human error, particularly issuing a shutdown command in the wrong terminal. The molly-guard package is a lightweight security utility designed specifically for Debian and Debian-based systems to prevent catastrophic accidental reboots and shutdowns. This article explains how molly-guard integrates into the operating system, intercepts dangerous system commands initiated over SSH, and forces administrators to verify target machines before executing disruptive power actions.

The Mechanics of Interception

When installed on a Debian instance, molly-guard replaces the standard paths of critical power-management commands—specifically reboot, halt, poweroff, and shutdown—with symlinks or wrapper scripts pointing to the /usr/sbin/molly-guard binary.

When a user executes one of these commands, molly-guard does not immediately execute the kernel-level power state change. Instead, it checks the environment variables of the running shell to determine whether the session was initiated remotely via SSH (evaluating variables such as SSH_CONNECTION or checking terminal session origins).

The Hostname Challenge

If an SSH session is detected, molly-guard interrupts the standard execution flow and prompts the administrator with an explicit challenge:

W: molly-guard: SSH session detected! Please type the FQDN of the machine to reboot:

To proceed, the administrator must manually type the exact host name or fully qualified domain name (FQDN) of the target machine.

  • If the entered name matches: molly-guard calls the original system binaries (typically preserved under /lib/molly-guard/ or directly invoking systemctl) and carries out the shutdown or reboot as requested.
  • If the entered name does not match or the user presses Ctrl+C: The command immediately aborts, leaving the machine running with no change in state.

Preventing Multi-Terminal Mistakes

The primary vulnerability molly-guard addresses is terminal confusion. System engineers often keep multiple SSH sessions open concurrently across staging, testing, and production environments. A command meant for a local test VM can easily be pasted into a production database window by mistake.

By requiring the user to physically type the specific hostname of the server they are logged into, molly-guard breaks automatic typing reflexes and enforces a cognitive pause, ensuring the operator consciously acknowledges which physical or virtual instance is about to go offline.

Configuration and Script Hooks

molly-guard behavior can be tailored through its configuration file located at /etc/molly-guard/rc. Administrators can customize parameters such as:

  • Always prompting: Forcing the challenge even for local console sessions, not just SSH logins.
  • Script execution: molly-guard runs scripts placed in /etc/molly-guard/run.d/ prior to triggering the power action. This allows administrators to inject custom pre-flight checks, such as verifying that certain critical services are properly drained or alerting monitoring systems before the shutdown sequence is handed over to systemd.