4

I'm currently working on a CentOS system (with Gnome desktop), where i want to disable the use of console for non allowed users. Actually when logging in with a standard user it launch my app and there is no way to access the desktop, but the user can still user VT switch to issue some command. In the other hand when logging as an administrator it will splash the desktop.

What I want to do is prevent a standard user from issuing commands but enable it for an administator.

I've tried so far modifiying /etc/X11/xorg.conf to disable terminal switching (Option "DontVTSwitch" "True") with success but it will prevent using it for every user.

Question :

Is there a way to allow VT switching for a certain user and disable it for other users ?

  • While an interesting question, I guess for your case it would not be strictly, necessary, would it? Disabling VT switching for everyone should be sort of fine, as the administrator could still use an xterm or another graphical console application. Or are there any reasonable objections to that? – inVader Mar 23 '15 at 15:53
  • This may have some objection from my client but nothing really formal other than "I don't want that to be disabled", so I was looking for something that will let admin to get full functionnalities. – Jaay Mar 23 '15 at 15:58
  • There is vlock(1) (linux.die.net/man/1/vlock), that is able to lock down either the currenct VC or all VC (where the latter one unfortunatelly also disables the console running X), requiring the root password to unlock. I don't know if you see any way you could make use of that, maybe. – inVader Mar 23 '15 at 16:17
  • I haven't tried it, but you can edit /etc/security/time.conf to disable the ability for specific users to login on the VT's (which are usually tty1 through tty7). So they can switch to them all they want (just as they can when presented with the gdm login screen), but they won't be able to get past the login prompt. – Mark Plotnick Mar 23 '15 at 22:26
  • @MarkPlotnick, I'm studying your proposition wich seems nice, I am not familiar with what's possible in time.conf, can you post some example as a response for my problem? – Jaay Mar 24 '15 at 8:55
3

You can use the pam_time PAM module to restrict logins for certain users on certain tty's (and at certain times of the day, which is the module's main use).

So if you want to tell the system that logins on tty0 through tty7 (that is, all the VT's that are typically enabled) for all users other than root are never allowed, add this line to /etc/security/time.conf:

login ; tty0|tty1|tty2|tty3|tty4|tty5|tty6|tty7 ; !root ; !Al0000-2400

and then add the following line at or near the first account line in /etc/pam.d/login:

account  required  pam_time.so

Users will still be able to login by using the gdm login screen. And while they can switch to a VT before (or after) logging in, all they'll be able to do is see the login and password prompts; they won't be able to login successfully on a VT.

Tested on CentOS 6.6.

| improve this answer | |
  • That is working perfectly, I will tune it for my need but this is a really cool solution. Thx – Jaay Mar 25 '15 at 9:04
0

If you are running on CentOS 7, the systemd-logind service may be able to handle this for you. It is responsible for session switch management and multi seat management. The loginctl command controls it - the loginctl link below has all the flags available.

http://www.freedesktop.org/software/systemd/man/systemd-logind.service.html http://www.freedesktop.org/software/systemd/man/loginctl.html

| improve this answer | |
  • 2
    This is not about session switching but virtual terminal (shortcut CTRL+ALT+Fx), so I'm afraid that will not work for me – Jaay Mar 23 '15 at 15:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.