I was thinking of a reliable way to lock a grml box. Logging out is not possible due to the respawn-feature of init.
The solution is to run 'passwd && vlock -a'. This sets a password for the current user (which is disabled by default for security reasons) and then locks the current console and disables switching to other consoles.