3

I have Ubuntu 18 OS and I am trying to prevent all users from running 'chpasswd' command after 17:00 o'clock. I need to use pam for this.

My /etc/pam.d/chpasswd file:

# The PAM configuration file for the Shadow 'chpasswd' service
#

@include common-password

password required       pam_pwquality.so retry=3
account required pam_time.so

My /etc/security/time.conf file:

chpasswd;*;myUser;!Al1700-2400

I don't know why it does not work. I can run this command all day.

0

You cannot prevent that users will be able to run chpasswd using pam_time.so, as this only ensures that the PAM permission check will fail when a user actually tries to change his or her password.

If your goal is to prevent users from changing their password using chpasswd during the specified hours in /etc/security/time.conf this approach should suffice.

If you want to prevent users from running chpasswd you would need to add something like this cronjob (e.g./etc/cron.d/disable_chpasswd) that disables the permissions for other users to run this program at the specified hour.

# disable chpasswd daily at 5pm
0 17 * * * root /usr/bin/chmod 4750 /usr/bin/chpasswd
# enable  chpasswd daily at 5am
0  5 * * * root /usr/bin/chmod 4755 /usr/bin/chpasswd

However, if you want to prevent users from changing their password altogether you can't rely on pam_time.so (or such a cronjob) because users would still be able to change their password using passwd (which as far as I know does not use the account management group) or possibly other methods (e.g. some graphical tools use the D-Bus interface provided by AccountsService). To circumvent that you could for example set up a cron job that disables and enables password changing in your PAM configuration (but I don't know if this would be a viable solution for you).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.