In this lesson, you will learn how to harden your server by enforcing strict operational windows for user logins using the pam_time module.
The Logic of Time-Based Access
In many enterprise environments, administrative or development accounts do not need 24/7 access to production systems. By leveraging the pam_time.so module, you can define specific time intervals during which a user is authorized to authenticate. If a user attempts to log in outside of these windows, the PAM stack will reject the connection, even if their password is correct.
Configuring Access Rules
The configuration is split into two parts: the definition file and the PAM stack integration.
First, define your restrictions in /etc/security/time.conf. Each entry follows a syntax of services;ttys;users;times. For example, to restrict the user dev_user to working only on weekdays from 9:00 AM to 5:00 PM, add this line:
# service;ttys;users;times
sshd;*;dev_user;Wk0900-1700
sshd: Applies the rule specifically to SSH logins.*: Applies the rule regardless of the terminal type.dev_user: The target account.Wk0900-1700: Represents the time window (Workdays, 09:00 to 17:00).
Integrating into the PAM Stack
Once the rules are defined, you must instruct the system to consult them during authentication. Open /etc/pam.d/sshd and add the following line to the account section:
account required pam_time.so
When a user tries to authenticate via SSH, the system will now pass the request to pam_time.so. The module checks the current system time against your rules in time.conf. If the current time falls outside the permitted window, the module returns a failure, effectively locking the door to unauthorized off-hour access.
Key Takeaway: By implementing pam_time, you reduce the attack surface of your servers by ensuring that accounts are only capable of active authentication during defined, business-appropriate hours.