Scroll to navigation

PAM_SESSION_TIMELIMI(8) System Managers Manual PAM_SESSION_TIMELIMI(8)

NAME

pam_session_timelimit - Module to impose daily time limits on user sessions

SYNOPSIS

pam_session_timelimit.so [...]

DESCRIPTION

The pam_session_timelimit PAM module interfaces with systemd to limit the length of time that a user can use a service. This is a per-day time limit; each successive session counts against the limit and reduces the time available on a given day for remaining sessions.

The time used by a session is only recorded at the session end. It is therefore possible to exceed the absolute limit by launching sessions in parallel.

By default the settings for per-user session time limits are taken from the config file /etc/security/time_limits.conf. An alternate file can be specified with the path option.

Time limits in this config file are expressed using the syntax described in systemd.time(7).

The config file format does not support configuring different time limits for different services. To achieve this, use different path options for each service.

OPTIONS

path=/path/to/time_limits.conf

Indicate an alternative configuration file following the time_limits.conf format to override the default.

statepath=/path/to/session_state

Indicate an alternative state file where the module should record each user's used session time for the day.

MODULE TYPES PROVIDED

The account and session module types are provided.

RETURN VALUES

PAM_SUCCESS

Access was granted.

PAM_PERM_DENIED

The user is not allowed access at this time.

PAM_BUF_ERR

Memory buffer error.

PAM_SYSTEM_ERR

An unexpected error was encountered.

PAM_SESSION_ERR

The session was not opened correctly and therefore cannot be closed correctly.

PAM_BAD_ITEM

The module could not identify the user to be given access.

PAM_IGNORE

No session limit has been configured for this user.

FILES

/etc/security/time_limits.conf

Default configuration file

/var/lib/session_times

Default state file

EXAMPLES

#%PAM-1.0
#
# apply pam_session_timelimit accounting to login requests
#
login  account  required  pam_session_timelimit.so
login  session  required  pam_session_timelimit.so

SEE ALSO

systemd.time(7), pam.d(5), pam(7).

AUTHOR

pam_session_timelimit was written by Steve Langasek <vorlon@dodds.net>.

10/29/2024 System Manager's Manual