Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm looking for something like LeechBlock, or StayFocusd on steroids, i.e. something that could block my Internet access temporarily, but do it in a way that would be a major hassle to disable, unlike these browser plug-ins (A "major hassle" is something like re-installing the OS)

If I create a "restricted" account, block its Internet access and exclude it from sudoers, it would work for me, but only if I could somehow lock myself out of my primary account on the machine, temporarily.

Can this be done in Ubuntu? (I'm sticking with 11.04, but I would consider upgrading or paying for this feature)

Simply letting someone else be the admin of my machine is not an acceptable solution for me.

Something like a cron job temporarily resetting the password might do the job, but it would have to be something very reliable, obviously. I can't risk being permanently locked out, because the machine had to reboot, etc.

I also asked a more general version of this question, in productivity.SE.

share|improve this question
up vote 6 down vote accepted


A nice not so easy to overcome approach to achieve a temporary lock out from your account is to define rules for the pluggable authentication module pam_time. By doing so we can define a certain time of the day when we are allowed to log in and use our account. Login will result with authentication failure outside these defined hours.

Tell lightdm to use pam_time:

To apply pam_time we edit /etc/pam.d/lightdm to add the following line:

account    required

Define rules for pam_time:

All rules for pam_time are stored in /etc/security/time.conf. See the manpage for time.conf for details on the syntax. To e.g. deny login for user oleg on workdays from 8:00 a.m. to 5:00 p.m. we add the following line there:

login; *; oleg; !Wd0800-1700

To overcome these rules we may comment out the added lines from a root access (e.g. by booting a live system or with another user account).

Other than restricting access we may consider to further narrow this down to only some services we may not want to have access:

http; *; oleg; !Wd0800-1700

will disable internet access for user oleg on weekdays from 8 a.m. to 5 p.m..

share|improve this answer

As suggested by another user in the linked discussion, the pam_time module is capable of locking out users temporarily.

share|improve this answer
Was just writing an answer on that ;) – Takkat Sep 3 '12 at 11:13

If you think it will be too easy to disable PAM with a live CD:

  1. Create an init script that runs first on boot, checks the system clock, and determines if the current time is allowed. If the current time is valid, have the script start a custom run-level that automatically logs in a user and starts X for them. If rescue mode was selected, don't follow the normal procedure and change the runlevel to the custom made one. This user must not be able to su root or be in sudoers. Be sure to use a test system first, until you are confident that the changes you made to /etc/rc* and /etc/init* will properly mount and unmount filesystems, and won't otherwise damage the system. Access to virtual consoles will have to be modified, or simply don't start any of them.

  2. Set the boot priority in BIOS to the hard drive first, to make booting into a live CD impossible.

  3. Set the BIOS password to something easy to forget, and set up an email reminder service to send it back to you at a specific time. You can use free services for this from sites such as, or

The only ways to circumvent this will be to open up the computer, and either take out the hard drive and modify the files, or reset the BIOS so you can change the time. If your computer has a way to lock the chassis, you could lock it using a lock with a combination you can forget, and also send an email reminder for the combination for a set time in the future.

share|improve this answer
I just thought of an easier alternative for step one. It is not necessary to modify the first init script or the rescue mode script. Instead, configure the boot manager so that the user can't change any options. Automatically boot a kernel with a specific runlevel: the custom run level as described. You will still have to configure the runlevel so that the display manager does not run and add a script to start the windows environment for your user. – user141238 Mar 20 '13 at 0:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.