Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The /etc/security/time.conf man page contains this example:

All users except for root are denied access to console-login at all times:

    login ; tty* & !ttyp* ; !root ; !Al0000-2400

For this to work, /etc/pam.d/login needs to have a line

account    requisite

This example works, and I tried to adapt it to limit HTTP access from the console rather than login. I added

http ; tty* & !ttyp* ; !root ; !Al0000-2400 # will fix "time" later

to /etc/security/time.conf, and created /etc/pam.d/http with

account    requisite

This doesn't work. I can still use wget as non-root from the console. Am I doing something wrong?

Here are some examples where people claim to be using PAM to restrict HTTP (!) access (I couldn't get them to work, so I wanted to start with something simpler, as in the above) :

share|improve this question
PAM is not the right solution for what you're trying to do. PAM is designed to handle various aspects of logging in and creating a 'session'. It does not define what you can do once you're in a session. The apps that are using pam have to be written to actually use pam. If the person is already on the console on the command line, it's too late for PAM. If what you're trying to do is to block the http protocol at a network level, you should be looking at your firewall. – yoonix Feb 27 '13 at 1:10
You could accomplish this with netfilter's "time" and "owner" modules. – Mark Wagner Feb 27 '13 at 1:24
@yoonix You should post that as an answer :-) – voretaq7 Feb 27 '13 at 1:28
@yoonix I added some references where people claim to be restricting HTTP with PAM. – MaxB Feb 27 '13 at 2:50
up vote 2 down vote accepted

Others have tried to drive the point home (and are correct), but I'm going to focus on the cited examples that are leading you astray and how they have no relevance to the command you are running as your test. (wget)

PAM is not a magical thing that lives at the kernel level; individual applications have to call the PAM stack in order for it to make a decision about whether or not some kind of access is permitted. Even then, the application must provide its own logic to implement whatever decision that the PAM library makes.

In the examples you're citing, access is being denied to any applications that call the PAM library and identify themselves with a service type of http. Unless the application is explicitly configured to link to the PAM library, this will accomplish all of nothing.

To further prove the point, here are the libraries that wget on my Debian system is linked against. Note the absence of anything with the acronym "pam".

$ ldd /usr/bin/wget =>  (0xb77c5000) => /usr/lib/i686/cmov/ (0xb776c000) => /usr/lib/i686/cmov/ (0xb7614000) => /lib/i686/cmov/ (0xb7610000) => /lib/i686/cmov/ (0xb7606000) => /lib/i686/cmov/ (0xb74bf000) => /usr/lib/ (0xb74ab000)
    /lib/ (0xb77c6000) => /lib/i686/cmov/ (0xb7492000)

No PAM library anywhere in that. Meanwhile, here's /bin/login and /usr/sbin/sshd...note the presence of

$ ldd /bin/login =>  (0xb7723000) => /lib/ (0xb770a000) => /lib/ (0xb7707000) => /lib/i686/cmov/ (0xb75c0000) => /lib/i686/cmov/ (0xb75bb000) => /lib/i686/cmov/ (0xb7589000)
    /lib/ (0xb7724000)

$ ldd /usr/sbin/sshd =>  (0xb77c0000) => /lib/ (0xb7737000) => /lib/ (0xb772b000) => /lib/ (0xb7710000) => /usr/lib/i686/cmov/ (0xb75b7000) => /lib/i686/cmov/ (0xb75b3000) => /usr/lib/ (0xb759f000) => /lib/i686/cmov/ (0xb756d000) => /usr/lib/ (0xb753e000) => /usr/lib/ (0xb748b000) => /lib/ (0xb7488000) => /lib/i686/cmov/ (0xb7341000) => /lib/i686/cmov/ (0xb732a000) => /lib/i686/cmov/ (0xb7326000)
    /lib/ (0xb77c1000) => /usr/lib/ (0xb7302000) => /usr/lib/ (0xb72fb000) => /lib/ (0xb72f8000) => /lib/i686/cmov/ (0xb72e4000) => /lib/i686/cmov/ (0xb72cb000)

Unless you are designing a very specific solution that involves an application linked to PAM making calls to the http service, this will not accomplish what you are trying to make it do.

Full-disclosure: There is nothing to stop any of the programs you run ldd against from dynamically loading a code module that is linked to PAM. (wget is not designed with a modular architecture, so the logic here still holds)

share|improve this answer
Thanks! Would I be correct in concluding then that the "http" example in my second link (parental control) is mistaken? (E.g. /usr/lib/firefox/firefox does not link to PAM in Ubuntu, so this parental control attempt wouldn't accomplish anything) – MaxB Feb 27 '13 at 4:01
@MaxB Unfortunately, there's no provided context for what application they're attempting to control by limiting the http service. (correct me if I'm wrong, I did try to locate it) So the only thing that can be really said is "that might have worked for what they were doing". – Andrew B Feb 27 '13 at 4:05
I'll ask hhlp what he tried to accomplish there. – MaxB Feb 27 '13 at 4:13
... never mind. I don't have enough karma to comment in AskUbuntu – MaxB Feb 27 '13 at 4:15

The PAM (Pluggable Authentication Modules) is for user authentication, i.e., it has to do with users logging in to the system. HTTP has nothing whatsoever to do here.

share|improve this answer
I added references where people claim to be restricting HTTP with PAM. – MaxB Feb 27 '13 at 2:50

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.