I've read that PAM can be used to restrict HTTP access for some users, but I can't figure out how to do it in Ubuntu 12.04.

The /etc/security/time.conf man page contains this example:

All users except for root are denied access to console-login at all times:

    login ; tty* & !ttyp* ; !root ; !Al0000-2400

For this to work, /etc/pam.d/login needs to have a line

account    requisite  pam_time.so

This example works, and I tried to adapt it to limit HTTP access from the console. I added

http ; tty* & !ttyp* ; !root ; !Al0000-2400

to /etc/security/time.conf, and created /etc/pam.d/http with

account    requisite  pam_time.so

This doesn't work. I can still use wget as non-root from the console.


You can't -- wget doesn't use PAM. A program must be explicitly designed to call PAM for it to have any affect. If you heard PAM could be used with HTTP, then it may have been a conversation about using PAM to authenticate a user trying to log in to a web site.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.