Most admins have to support system logins in one form or another. These logins include everything from application service accounts, operations accounts, SysAdmin accounts and pretty much everything else you can think of. Some of these accounts may not need to access your servers 24⁄7, and you may want to limit the timeframes when users or groups of users can login. This is super easy to do on Linux systems with the pam_time module.
Pam_time is pretty simple. To configure it to allow logins during a specified time period, you can edit /etc/security/time.conf and add entries to limit access. Entries in this file take the following format:
PAM SERVICE NAME;TTYS;USER LIST;TIME TO ALLOW / DISALLOW ACCESS
The pam service name contains the name of the pam service to disallow access to, the ttys field controls the devices to limit access to, the user list contains the users to deny access to, and the time field controls allows you to list the times when a user can login. Here is an sample entry:
In the example above, the users haroldp and kumarj would only be able to login via ssh between the hours of 9am and 5pm. To enforce the limits in the time.conf configuration file, you will need to add the pam_time.so module to the account section in your pam configuration. For a CentOS server, you can append the pam_time entry to the top of the account section in /etc/pam.d/system-auth:
account required pam_time.so **<--- New entry** account required pam_unix.so account sufficient pam_succeed_if.so uid < 500 quiet account required pam_permit.so
If a user tries to login outside of the hours listed in the fourht field above, they will be denied access. One important note regarding the time field. This field contains the times you WANT to grant access. To deny access during a time range you will need to append a bang (!) to the time. This module gives a whole new flare to the phrase “ACCESS DENIED!“. :)