I'm looking for something like LeechBlock, or StayFocusd on steroids, i.e. something that could block my Internet access temporarily, but do it in a way that would be a major hassle to disable, unlike these browser plug-ins (A "major hassle" is something like re-installing the OS)

If I create a "restricted" account, block its Internet access and exclude it from sudoers, it would work for me, but only if I could somehow lock myself out of my primary account on the machine, temporarily.

Can this be done in Ubuntu? (I'm sticking with 11.04, but I would consider upgrading or paying for this feature)

Simply letting someone else be the admin of my machine is not an acceptable solution for me.

Something like a cron job temporarily resetting the password might do the job, but it would have to be something very reliable, obviously. I can't risk being permanently locked out, because the machine had to reboot, etc.

I also asked a more general version of this question, in productivity.SE.

3 Answers 3



A nice not so easy to overcome approach to achieve a temporary lock out from your account is to define rules for the pluggable authentication module pam_time. By doing so we can define a certain time of the day when we are allowed to log in and use our account. Login will result with authentication failure outside these defined hours.

Tell lightdm to use pam_time:

To apply pam_time we edit /etc/pam.d/lightdm to add the following line:

account    required    pam_time.so

Define rules for pam_time:

All rules for pam_time are stored in /etc/security/time.conf. See the manpage for time.conf for details on the syntax. To e.g. deny login for user oleg on workdays from 8:00 a.m. to 5:00 p.m. we add the following line there:

login; *; oleg; !Wd0800-1700

To overcome these rules we may comment out the added lines from a root access (e.g. by booting a live system or with another user account).

Other than restricting access we may consider to further narrow this down to only some services we may not want to have access:

http; *; oleg; !Wd0800-1700

will disable internet access for user oleg on weekdays from 8 a.m. to 5 p.m..


As suggested by another user in the linked discussion, the pam_time module is capable of locking out users temporarily.

  • Was just writing an answer on that ;)
    – Takkat
    Sep 3, 2012 at 11:13

If you think it will be too easy to disable PAM with a live CD:

  1. Create an init script that runs first on boot, checks the system clock, and determines if the current time is allowed. If the current time is valid, have the script start a custom run-level that automatically logs in a user and starts X for them. If rescue mode was selected, don't follow the normal procedure and change the runlevel to the custom made one. This user must not be able to su root or be in sudoers. Be sure to use a test system first, until you are confident that the changes you made to /etc/rc* and /etc/init* will properly mount and unmount filesystems, and won't otherwise damage the system. Access to virtual consoles will have to be modified, or simply don't start any of them.

  2. Set the boot priority in BIOS to the hard drive first, to make booting into a live CD impossible.

  3. Set the BIOS password to something easy to forget, and set up an email reminder service to send it back to you at a specific time. You can use free services for this from sites such as http://www.kisreminder.com/, or http://www.nudgemail.com/how/.

The only ways to circumvent this will be to open up the computer, and either take out the hard drive and modify the files, or reset the BIOS so you can change the time. If your computer has a way to lock the chassis, you could lock it using a lock with a combination you can forget, and also send an email reminder for the combination for a set time in the future.

  • I just thought of an easier alternative for step one. It is not necessary to modify the first init script or the rescue mode script. Instead, configure the boot manager so that the user can't change any options. Automatically boot a kernel with a specific runlevel: the custom run level as described. You will still have to configure the runlevel so that the display manager does not run and add a script to start the windows environment for your user.
    – user141238
    Mar 20, 2013 at 0:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .