File: lockout.1

package info (click to toggle)
lockout 0.2.3-5
  • links: PTS, VCS
  • area: main
  • in suites: bullseye, buster, sid
  • size: 140 kB
  • sloc: perl: 492; makefile: 14; sh: 2
file content (288 lines) | stat: -rw-r--r-- 9,863 bytes parent folder | download | duplicates (2)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
.\" Automatically generated by Pod::Man v1.37, Pod::Parser v1.14
.\"
.\" Standard preamble:
.\" ========================================================================
.de Sh \" Subsection heading
.br
.if t .Sp
.ne 5
.PP
\fB\\$1\fR
.PP
..
.de Sp \" Vertical space (when we can't use .PP)
.if t .sp .5v
.if n .sp
..
.de Vb \" Begin verbatim text
.ft CW
.nf
.ne \\$1
..
.de Ve \" End verbatim text
.ft R
.fi
..
.\" Set up some character translations and predefined strings.  \*(-- will
.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
.\" double quote, and \*(R" will give a right double quote.  | will give a
.\" real vertical bar.  \*(C+ will give a nicer C++.  Capital omega is used to
.\" do unbreakable dashes and therefore won't be available.  \*(C` and \*(C'
.\" expand to `' in nroff, nothing in troff, for use with C<>.
.tr \(*W-|\(bv\*(Tr
.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
.ie n \{\
.    ds -- \(*W-
.    ds PI pi
.    if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
.    if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\"  diablo 12 pitch
.    ds L" ""
.    ds R" ""
.    ds C` ""
.    ds C' ""
'br\}
.el\{\
.    ds -- \|\(em\|
.    ds PI \(*p
.    ds L" ``
.    ds R" ''
'br\}
.\"
.\" If the F register is turned on, we'll generate index entries on stderr for
.\" titles (.TH), headers (.SH), subsections (.Sh), items (.Ip), and index
.\" entries marked with X<> in POD.  Of course, you'll have to process the
.\" output yourself in some meaningful fashion.
.if \nF \{\
.    de IX
.    tm Index:\\$1\t\\n%\t"\\$2"
..
.    nr % 0
.    rr F
.\}
.\"
.\" For nroff, turn off justification.  Always turn off hyphenation; it makes
.\" way too many mistakes in technical documents.
.hy 0
.if n .na
.\"
.\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
.\" Fear.  Run.  Save yourself.  No user-serviceable parts.
.    \" fudge factors for nroff and troff
.if n \{\
.    ds #H 0
.    ds #V .8m
.    ds #F .3m
.    ds #[ \f1
.    ds #] \fP
.\}
.if t \{\
.    ds #H ((1u-(\\\\n(.fu%2u))*.13m)
.    ds #V .6m
.    ds #F 0
.    ds #[ \&
.    ds #] \&
.\}
.    \" simple accents for nroff and troff
.if n \{\
.    ds ' \&
.    ds ` \&
.    ds ^ \&
.    ds , \&
.    ds ~ ~
.    ds /
.\}
.if t \{\
.    ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
.    ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
.    ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
.    ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
.    ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
.    ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
.\}
.    \" troff and (daisy-wheel) nroff accents
.ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
.ds 8 \h'\*(#H'\(*b\h'-\*(#H'
.ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
.ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
.ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
.ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
.ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
.ds ae a\h'-(\w'a'u*4/10)'e
.ds Ae A\h'-(\w'A'u*4/10)'E
.    \" corrections for vroff
.if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
.if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
.    \" for low resolution devices (crt and lpr)
.if \n(.H>23 .if \n(.V>19 \
\{\
.    ds : e
.    ds 8 ss
.    ds o a
.    ds d- d\h'-1'\(ga
.    ds D- D\h'-1'\(hy
.    ds th \o'bp'
.    ds Th \o'LP'
.    ds ae ae
.    ds Ae AE
.\}
.rm #[ #] #H #V #F C
.\" ========================================================================
.\"
.IX Title "LOCKOUT 1"
.TH LOCKOUT 1 "2004-09-08" "lockout" "lockout"
.SH "NAME"
lockout \- avoid slacking and impose productivity and discipline on yourself
.SH "WARNING"
.IX Header "WARNING"
This program is \s-1VERY\s0 \s-1DANGEROUS\s0.  If it fails, you may end up not knowing the
root password to your own computer (in which case you need to boot into
single-user mode).  There are no known reports of this actually happening, but
we don't know how stupid you are.  Also, you should probably not run this on a
multi-user system.
.SH "SYNOPSIS"
.IX Header "SYNOPSIS"
.Vb 5
\& lockout lock HhMm | Hh | Mm
\& lockout lock HH:MM
\& lockout lock HH:MMam | HH:MMpm
\& lockout lock HHam | HHpm
\& lockout lock
.Ve
.PP
.Vb 1
\& lockout unlock [force]
.Ve
.PP
.Vb 1
\& lockout status
.Ve
.SH "DESCRIPTION"
.IX Header "DESCRIPTION"
Lockout is a tool that imposes discipline on you so that you get some work
done.  For example, lockout can be used to install a firewall that does not
let you browse the Web.  Lockout changes the root password for a specified
duration; this prevents you from secretly ripping down the firewall and then
browsing the Web anyway.  In case of an emergency, you can reboot your
computer to undo the effects of lockout and to restore the original root
password.
.PP
Obviously, \fBlockout lock\fR and \fBlockout unlock\fR can only be run by root.
\&\fBlockout status\fR can be run by any user.
.PP
\&\fBlockout\fR without any parameters shows a brief help message.
.PP
\&\fBlockout lock\fR takes one optional parameter.  If no parameter is given, you
are dropped in interactive mode and asked for the duration of the lock or the
time at which the lock should be lifted.  You can also supply this as a
parameter on the command line.  Lockout understands various time formats.  You
can specify a delay, e.g., \fI3h\fR (3 hours), \fI1h30m\fR (1 hour and 30 minutes),
or \fI90m\fR (1 hour and 30 minutes), or you can specify absolute time, e.g.,
\&\fI2pm\fR, \fI2:30am\fR, \fI15:30\fR, etc.  You will be asked to confirm the time at
which lockout will unlock your system.  If you type \*(L"yes\*(R", lockout executes
\&\fI/etc/lockout/lock.sh\fR and changes the root password to something completely
random.  \fI/etc/lockout/lock.sh\fR is a shell script that you write.  It takes
measures to make sure you stop slacking.  For example, it could install a
firewall that prevents outgoing connections to port 80.  See the \*(L"\s-1EXAMPLES\s0\*(R"
section below.
.PP
\&\fBlockout unlock\fR takes an optional \fIforce\fR parameter.  Without any
parameters, \fBlockout lock\fR will check whether it is time to unlock the system
and, if so, executes \fI/etc/lockout/unlock.sh\fR, which is a shell script that
you write.  It should undo the effects of \fI/etc/lockout/lock.sh\fR, executed
when the system was locked.  If you pass the \fIforce\fR parameter to \fBlockout
unlock\fR, lockout will forcibly unlock your system, whether it was really time
for that or not.  \fBlockout unlock\fR should be called every minute by cron.
See \*(L"\s-1CONFIGURATION\s0\*(R".
.PP
\&\fBlockout status\fR will print out the time at which the system is going to
be unlocked.
.SH "CONFIGURATION"
.IX Header "CONFIGURATION"
/etc/cron.d/lockout \fBmust\fR contain the following two entries:
.PP
.Vb 2
\&    */1 * * * *         root    /usr/bin/lockout unlock >/dev/null 2>&1
\&    @reboot             root    /usr/bin/lockout unlock force >/dev/null 2>&1
.Ve
.PP
The examples that follow assume you are using \fIsudo\fR\|(8) and you have a file,
\&\fI/etc/lockout/sudoers.normal\fR which is the normal \fI/etc/sudoers\fR file, and
\&\fI/etc/lockout/sudoers.lock\fR, which is the \fI/etc/sudoers\fR file when lockout
locks your computer.  This example also assumes you are using \fIiptables\fR\|(8).
\&\fI/var/lib/iptables/active\fR should contain your default firewall rules, and
\&\fI/var/lib/iptables/work\fR should contain the firewall rules that enforce
discipline.  See below for an example.
.PP
\&\fI/etc/lock/lock.sh\fR imposes discipline.  For example:
.PP
.Vb 5
\&    #!/bin/sh
\&    /etc/init.d/iptables load work
\&    cp /etc/lockout/sudoers.lock /etc/sudoers
.Ve
.PP
\&\fI/etc/lock/unlock.sh\fR undoes these effects.  For example:
.PP
.Vb 5
\&    #!/bin/sh
\&    /etc/init.d/iptables restart
\&    cp /etc/lockout/sudoers.normal /etc/sudoers
.Ve
.PP
Your \fI/var/lib/iptables/work\fR may look something like this:
.PP
.Vb 4
\&    *filter
\&    :INPUT ACCEPT [1047:99548]
\&    :FORWARD ACCEPT [0:0]
\&    :OUTPUT ACCEPT [1104:120792]
.Ve
.PP
.Vb 7
\&    # allow incoming packets from localhost, ntp,
\&    # and existing connections
\&    -A INPUT -i lo -j ACCEPT
\&    -A INPUT -p udp -m udp --source-port ntp -m state --state ESTABLISHED -j ACCEPT
\&    -A INPUT -m state --state ESTABLISHED -j ACCEPT
\&    -A INPUT -p tcp -j DROP
\&    -A INPUT -p udp -j DROP
.Ve
.PP
.Vb 7
\&    # allow outgoing connections for email and DNS
\&    -A OUTPUT -d 127.0.0.1/8 -j ACCEPT
\&    -A OUTPUT -p tcp -m tcp --dport smtp -j ACCEPT
\&    -A OUTPUT -p tcp -m tcp --dport domain -j ACCEPT
\&    -A OUTPUT -p udp -m udp --dport domain -j ACCEPT
\&    -A OUTPUT -j DROP
\&    COMMIT
.Ve
.SH "EXAMPLES"
.IX Header "EXAMPLES"
.Vb 5
\&    lockout lock 2h30m   [locks out for 2h and 30m]
\&    lockout lock 90m     [locks out for 1h and 30m]
\&    lockout lock 3pm     [locks out until 3pm]
\&    lockout lock 3:20am  [locks out until 3:20am]
\&    lockout lock 15:20   [locks out until 3:20pm]
.Ve
.PP
.Vb 1
\&    lockout status       [shows when the system is going to be unlocked]
.Ve
.SH "FILES"
.IX Header "FILES"
\&\fI/etc/lockout/lock.sh\fR: executed when running \fBlockout lock\fR
.PP
\&\fI/etc/lockout/unlock.sh\fR: executed when running \fBlockout unlock\fR
.SH "SEE ALSO"
.IX Header "SEE ALSO"
\&\fIusermod\fR\|(8), \fIiptables\fR\|(8), \fIpasswd\fR\|(1), \fIcron\fR\|(8), \fIcrontab\fR\|(1)
.SH "BUGS"
.IX Header "BUGS"
Arguably, a program that changes the root password to something random with
the possibility of never recovering the original password might be considered
a bug by itself.  Other than that, no known bugs.
.SH "AUTHOR"
.IX Header "AUTHOR"
Thomer M. Gil, http://thomer.com/lockout/