Time-based access-lists in Cisco world are available since ... last century for sure. But is it possible that Linux doesn't have anything like that ? No way - of course it can do and do it better. Here is how .Access control based on time of the day is available via pam module, and as almost all software today supports working with pam modules, it means it is available universally.Steps to do for any networking service:
Enable pam_time.so module for the software of interest in its config file in /etc/pam.d ;
Configure time range(s) when this service is accepting connections using file /etc/security/time.conf
Most probably restart the service and we are set.
E.g. Let's restrict user ftp_user so that it is able to connect to vsftpd daemon only during working hours of the weekdays.
- Add to file /etc/pam.d/vsftpd the following line account required /lib/security/pam_time.so
- Set time limits in /etc/security/time.conf with this line vsftpd;*;ftp_user;Wk0800-1700- Restart vsftpd to force it using pam_time.so module (need to do it just first time)#service vsftpd restart
And now during the off-limit hours the ftp_user will not be able to connect by FTP, that is it .
For Checkpoint all the above holds true, but as you don't have much servers there , the most probable candidate for such restrictions is ssh daemon. For example firewall that the client has access by ssh to it as well - while mail alerts for such access (see Mail alert on ssh access in Checkpoint) will warn me about such access, it does me no good if someone on client side accesses the firewall at 02:00 am at night and I get alert . Example for limiting ssh access to the firewall to working hours only.
/etc/security/time.conf : sshd;*;client_user;Wk0900-1900
/etc/pam.d/sshd :account required /lib/security/pam_time.so
Related:
- Two tips to secure SSH access from specific IPs to specific users in Checkpoint or any Linux
Follow me on https://www.linkedin.com/in/yurislobodyanyuk/ not to miss what I publish on Linkedin, Github, blog, and more.
