8

Suppose a non-root user with sudo privileges executes a delayed shutdown (shutdown +10 or whatever) and logs out. Then, before the shutdown occurs, he wants to log back in and cancel the shutdown. The problem is that shutdown creates /etc/nologin, and login only allows root to log in when that file exists... is it possible to create an exception from this for a user?

If not, what would be the best way to let a user initiate a delayed shutdown, then logging in and cancelling it at a later point?

  • One could maybe use shutdown now with the at scheduler as a workaround. – jw013 Aug 2 '11 at 16:15
14

If your system uses PAM, the login denial when /etc/nologin exists is triggered by the pam_nologin module.

You can skip the pam_nologin invocation for users matching certain criteria with pam_succeed_if. For example, if you want to allow users in the adm group to log in on a text console even if /etc/nologin exists, add the following line to /etc/pam.d/login just before the line with auth requisite pam_nologin.so:

auth [default=ignore success=1] pam_succeed_if.so quiet user ingroup adm
2

Gilles's answer above is very good, but note you must match the "type" with pam_nologin.so's type. So for example, on my RHEL5 system:

account [default=1 success=ignore] pam_succeed_if.so quiet user ingroup nx
account required     pam_nologin.so

...if I used auth, as the other answer requested, it wouldn't work.

2

Vesa K's version of Ryan Novosielski's answer works for me, but the lines are in:

/etc/pam.d/sshd

not:

/etc/pam.d/login

In my case, I just want UID 1000 under Ubuntu 14.04 LTS to be allowed to login via SSH.

# Disallow non-root logins when /etc/nologin exists.
account [success=1 default=ignore] pam_succeed_if.so quiet uid eq 1000
account    required     pam_nologin.so
1

I'm not sure if it is possible to override the /etc/nologin creation/usage without dirty tricks. But for your purpose, you can use a function like this:

off () { 
   touch /tmp/GOING-DOWN
   sudo sh -c "sleep ${1-1} && [ -f /tmp/GOING-DOWN ] && /sbin/poweroff"
}

Upon re-login, deleting the file /tmp/GOING-DOWN will prevent shutdown.

edit: Added a simple way to cancel the shutdown.

0

I tried Ryan's rule today and found out that Gils's and Ryan's answers bot have success/default rules "reversed", nologin blocks only nx-group. This is how I implemented this rule (nx group is not blocked by nologin).

account [success=1 default=ignore] pam_succeed_if.so quiet user ingroup nx
account required     pam_nologin.so

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.