The action taken for CTRL-ALT-DEL is defined in /etc/inittab and if we will look in that file we will see a line similar to the one from bellow (taken from a Debian system):
# What to do when CTRL-ALT-DEL is pressed. ca:12345:ctrlaltdel:/sbin/shutdown -t1 -a -r now
Here is another example: on RedHat based systems this line will look like:
ca::ctrlaltdel:/sbin/shutdown -t3 -r now
If we want to disable this action we only have to change this line. We can delete it, comment it, or even replace it with something like:
ca:12345:ctrlaltdel:/bin/echo "CTRL-ALT-DEL is disabled"
After making any changes to the inittab file, you will have to tell init to reload it, in order to activate the changes. To do that, simply run as root: