How to Completely Disable ‘Magic SysRq’ Keys System-Wide in Ubuntu Server

The “Magic SysRq key” is a low-level combination of keystrokes in the Linux kernel that allows users to send direct commands to the operating system, regardless of its current state. By pressing Alt + SysRq + [Command Key], a user with physical console access can instantly reboot the machine (REISUB), dump memory data, kill all processes, or forcefully remount all file systems as read-only. While invaluable for debugging a completely frozen server or safely rebooting a crashed kernel, leaving SysRq enabled on a production server with physical exposure (like a kiosk, a retail point-of-sale terminal, or an unmonitored server rack) is a significant security and denial-of-service risk.

This guide explains how to completely disable the Magic SysRq feature system-wide in Ubuntu Server.

Disable SysRq via sysctl

Ubuntu manages the SysRq feature via a specific kernel parameter (kernel.sysrq). To disable it permanently across reboots, we must configure a persistent sysctl rule.

1. Log into your Ubuntu Server via SSH or local console using an account with sudo privileges.
2. Create a new configuration file in the /etc/sysctl.d/ directory using a text editor like nano:

   sudo nano /etc/sysctl.d/99-disable-sysrq.conf

3. Add the following single line to the file, which instructs the kernel to ignore all SysRq requests:

   kernel.sysrq = 0

4. Save the file (in nano, press Ctrl+O, Enter, then Ctrl+X).
5. Apply the new kernel parameter immediately without requiring a reboot:

   sudo sysctl -p /etc/sysctl.d/99-disable-sysrq.conf

Verify the Lockdown

Once applied, the kernel will refuse to listen to any Magic SysRq interrupts from the keyboard.

To verify the kernel parameter is actively enforcing the lockdown, run the following command to check the current runtime value:

cat /proc/sys/kernel/sysrq

The output must simply be 0. (A value of 1 means all functions are enabled, while values like 176 indicate partial enablement). With the value set to 0, if a malicious actor gains physical access to the keyboard and attempts the “REISUB” sequence to force a hard reboot, the server will completely ignore the keystrokes, protecting your uptime and file system integrity.