I'm trying to use the
pam_time.so module to restrict the times at which some users may use
sudo. However, my configuration changes seem to have no effect. How can I debug this issue? Is it possible for my distro to change the location for
pam.d/sudo file already existed, and if I comment out other lines I can see the effect, but the
time.conf file did not exist anywhere in
/etc, so I might simply be modifying the wrong file.
Below is what I have attempted so far.
Here are the contents of
And here are the contents of
/etc/pam.d/su (the default on my distro, plus the first line to load
account required pam_time.so debug account required pam_unix.so auth sufficient pam_unix.so likeauth try_first_pass auth required pam_deny.so password requisite pam_unix.so nullok sha512 session required pam_env.so envfile=… session required pam_unix.so
When I try to use
journalctl -f prints:
août 09 13:53:15 nixos sudo: georges : TTY=pts/6 ; PWD=/home/georges ; USER=root ; COMMAND=/bin/sh août 09 13:53:15 nixos sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
/etc/pam.d/sudoseems to have no effect
- Some sources on the internet use
account requisite pam_time.soinstead of
required, but it makes no difference for me
pamtester -v sudo root open_sessiondoes not show any useful information (and succeeds), but
pamtester -v sudo root authenticaterejects my password, and the
journalctllog shows that, but the values in
time.confhave no effect:
août 09 13:56:03 nixos unix_chkpwd: check pass; user unknown août 09 13:56:03 nixos unix_chkpwd: password check failed for user (root)
I tried removing the
auth sufficient pam_unix.so …line, and sudo access gets prohibited without even trying a password, so I know changes in
pam_time.socannot be used as a
authmodule, however (the
journalctllog complains about a missing symbol).
- I tried rebooting the machine, but the configuration is still ignored.