0

I'm trying to use the pam_time.so module to restrict the times at which some users may use sudo. However, my configuration changes seem to have no effect. How can I debug this issue? Is it possible for my distro to change the location for /etc/security/time.conf? The pam.d/sudo file already existed, and if I comment out other lines I can see the effect, but the time.conf file did not exist anywhere in /etc, so I might simply be modifying the wrong file.

Below is what I have attempted so far.


Here are the contents of /etc/security/time.conf:

sudo;*;*;!Al0830-1700
su;*;*;!Al0830-1700

And here are the contents of /etc/pam.d/sudo and /etc/pam.d/su (the default on my distro, plus the first line to load pam_time.so).

account required pam_time.so debug
account required pam_unix.so
auth sufficient pam_unix.so  likeauth try_first_pass
auth required pam_deny.so
password requisite pam_unix.so nullok sha512
session required pam_env.so envfile=…
session required pam_unix.so

When I try to use sudo /bin/sh, journalctl -f prints:

août 09 13:53:15 nixos sudo[7454]:  georges : TTY=pts/6 ; PWD=/home/georges ; USER=root ; COMMAND=/bin/sh
août 09 13:53:15 nixos sudo[7454]: pam_unix(sudo:session): session opened for user root by (uid=0)
  • The debug in /etc/pam.d/sudo seems to have no effect
  • Some sources on the internet use account requisite pam_time.so instead of required, but it makes no difference for me
  • pamtester -v sudo root open_session does not show any useful information (and succeeds), but pamtester -v sudo root authenticate rejects my password, and the journalctl log shows that, but the values in time.conf have no effect:

    août 09 13:56:03 nixos unix_chkpwd[7965]: check pass; user unknown
    août 09 13:56:03 nixos unix_chkpwd[7965]: password check failed for user (root)
    
  • I tried removing the auth sufficient pam_unix.so … line, and sudo access gets prohibited without even trying a password, so I know changes in /etc/pam.d/sudo work. pam_time.so cannot be used as a auth module, however (the journalctl log complains about a missing symbol).

  • I tried rebooting the machine, but the configuration is still ignored.
0

The problem probably lies with two wildcards.

sudo;*;*;!Al0830-1700

According to the man page it can be only used once: "For these items the simple wildcard '*' may be used only once."

To circumvent this, you may use something like:

sudo;*;!root;!Al0830-1700

This applies the rule to every user (except root).

Edit: Scratch that, it works on my system. btw, you should test the account stack with pamtester -v sudo username acct_mgmt

  • So, you are saying your answer is wrong? – Blackwood Jan 14 '18 at 4:36

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.