.\" Automatically generated by Pod::Man v1.37, Pod::Parser v1.14
.\"
.\" Standard preamble:
.\" ========================================================================
.de Sh \" Subsection heading
.br
.if t .Sp
.ne 5
.PP
\fB\\$1\fR
.PP
..
.de Sp \" Vertical space (when we can't use .PP)
.if t .sp .5v
.if n .sp
..
.de Vb \" Begin verbatim text
.ft CW
.nf
.ne \\$1
..
.de Ve \" End verbatim text
.ft R
.fi
..
.\" Set up some character translations and predefined strings.  \*(-- will
.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
.\" double quote, and \*(R" will give a right double quote.  | will give a
.\" real vertical bar.  \*(C+ will give a nicer C++.  Capital omega is used to
.\" do unbreakable dashes and therefore won't be available.  \*(C` and \*(C'
.\" expand to `' in nroff, nothing in troff, for use with C<>.
.tr \(*W-|\(bv\*(Tr
.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
.ie n \{\
.    ds -- \(*W-
.    ds PI pi
.    if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
.    if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\"  diablo 12 pitch
.    ds L" ""
.    ds R" ""
.    ds C` ""
.    ds C' ""
'br\}
.el\{\
.    ds -- \|\(em\|
.    ds PI \(*p
.    ds L" ``
.    ds R" ''
'br\}
.\"
.\" If the F register is turned on, we'll generate index entries on stderr for
.\" titles (.TH), headers (.SH), subsections (.Sh), items (.Ip), and index
.\" entries marked with X<> in POD.  Of course, you'll have to process the
.\" output yourself in some meaningful fashion.
.if \nF \{\
.    de IX
.    tm Index:\\$1\t\\n%\t"\\$2"
..
.    nr % 0
.    rr F
.\}
.\"
.\" For nroff, turn off justification.  Always turn off hyphenation; it makes
.\" way too many mistakes in technical documents.
.hy 0
.if n .na
.\"
.\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
.\" Fear.  Run.  Save yourself.  No user-serviceable parts.
.    \" fudge factors for nroff and troff
.if n \{\
.    ds #H 0
.    ds #V .8m
.    ds #F .3m
.    ds #[ \f1
.    ds #] \fP
.\}
.if t \{\
.    ds #H ((1u-(\\\\n(.fu%2u))*.13m)
.    ds #V .6m
.    ds #F 0
.    ds #[ \&
.    ds #] \&
.\}
.    \" simple accents for nroff and troff
.if n \{\
.    ds ' \&
.    ds ` \&
.    ds ^ \&
.    ds , \&
.    ds ~ ~
.    ds /
.\}
.if t \{\
.    ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
.    ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
.    ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
.    ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
.    ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
.    ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
.\}
.    \" troff and (daisy-wheel) nroff accents
.ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
.ds 8 \h'\*(#H'\(*b\h'-\*(#H'
.ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
.ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
.ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
.ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
.ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
.ds ae a\h'-(\w'a'u*4/10)'e
.ds Ae A\h'-(\w'A'u*4/10)'E
.    \" corrections for vroff
.if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
.if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
.    \" for low resolution devices (crt and lpr)
.if \n(.H>23 .if \n(.V>19 \
\{\
.    ds : e
.    ds 8 ss
.    ds o a
.    ds d- d\h'-1'\(ga
.    ds D- D\h'-1'\(hy
.    ds th \o'bp'
.    ds Th \o'LP'
.    ds ae ae
.    ds Ae AE
.\}
.rm #[ #] #H #V #F C
.\" ========================================================================
.\"
.IX Title "LOCKOUT 1"
.TH LOCKOUT 1 "2004-09-08" "lockout" "lockout"
.SH "NAME"
lockout \- avoid slacking and impose productivity and discipline on yourself
.SH "WARNING"
.IX Header "WARNING"
This program is \s-1VERY\s0 \s-1DANGEROUS\s0.  If it fails, you may end up not knowing the
root password to your own computer (in which case you need to boot into
single-user mode).  There are no known reports of this actually happening, but
we don't know how stupid you are.  Also, you should probably not run this on a
multi-user system.
.SH "SYNOPSIS"
.IX Header "SYNOPSIS"
.Vb 5
\& lockout lock HhMm | Hh | Mm
\& lockout lock HH:MM
\& lockout lock HH:MMam | HH:MMpm
\& lockout lock HHam | HHpm
\& lockout lock
.Ve
.PP
.Vb 1
\& lockout unlock [force]
.Ve
.PP
.Vb 1
\& lockout status
.Ve
.SH "DESCRIPTION"
.IX Header "DESCRIPTION"
Lockout is a tool that imposes discipline on you so that you get some work
done.  For example, lockout can be used to install a firewall that does not
let you browse the Web.  Lockout changes the root password for a specified
duration; this prevents you from secretly ripping down the firewall and then
browsing the Web anyway.  In case of an emergency, you can reboot your
computer to undo the effects of lockout and to restore the original root
password.
.PP
Obviously, \fBlockout lock\fR and \fBlockout unlock\fR can only be run by root.
\&\fBlockout status\fR can be run by any user.
.PP
\&\fBlockout\fR without any parameters shows a brief help message.
.PP
\&\fBlockout lock\fR takes one optional parameter.  If no parameter is given, you
are dropped in interactive mode and asked for the duration of the lock or the
time at which the lock should be lifted.  You can also supply this as a
parameter on the command line.  Lockout understands various time formats.  You
can specify a delay, e.g., \fI3h\fR (3 hours), \fI1h30m\fR (1 hour and 30 minutes),
or \fI90m\fR (1 hour and 30 minutes), or you can specify absolute time, e.g.,
\&\fI2pm\fR, \fI2:30am\fR, \fI15:30\fR, etc.  You will be asked to confirm the time at
which lockout will unlock your system.  If you type \*(L"yes\*(R", lockout executes
\&\fI/etc/lockout/lock.sh\fR and changes the root password to something completely
random.  \fI/etc/lockout/lock.sh\fR is a shell script that you write.  It takes
measures to make sure you stop slacking.  For example, it could install a
firewall that prevents outgoing connections to port 80.  See the \*(L"\s-1EXAMPLES\s0\*(R"
section below.
.PP
\&\fBlockout unlock\fR takes an optional \fIforce\fR parameter.  Without any
parameters, \fBlockout lock\fR will check whether it is time to unlock the system
and, if so, executes \fI/etc/lockout/unlock.sh\fR, which is a shell script that
you write.  It should undo the effects of \fI/etc/lockout/lock.sh\fR, executed
when the system was locked.  If you pass the \fIforce\fR parameter to \fBlockout
unlock\fR, lockout will forcibly unlock your system, whether it was really time
for that or not.  \fBlockout unlock\fR should be called every minute by cron.
See \*(L"\s-1CONFIGURATION\s0\*(R".
.PP
\&\fBlockout status\fR will print out the time at which the system is going to
be unlocked.
.SH "CONFIGURATION"
.IX Header "CONFIGURATION"
/etc/cron.d/lockout \fBmust\fR contain the following two entries:
.PP
.Vb 2
\&    */1 * * * *         root    /usr/bin/lockout unlock >/dev/null 2>&1
\&    @reboot             root    /usr/bin/lockout unlock force >/dev/null 2>&1
.Ve
.PP
The examples that follow assume you are using \fIsudo\fR\|(8) and you have a file,
\&\fI/etc/lockout/sudoers.normal\fR which is the normal \fI/etc/sudoers\fR file, and
\&\fI/etc/lockout/sudoers.lock\fR, which is the \fI/etc/sudoers\fR file when lockout
locks your computer.  This example also assumes you are using \fIiptables\fR\|(8).
\&\fI/var/lib/iptables/active\fR should contain your default firewall rules, and
\&\fI/var/lib/iptables/work\fR should contain the firewall rules that enforce
discipline.  See below for an example.
.PP
\&\fI/etc/lock/lock.sh\fR imposes discipline.  For example:
.PP
.Vb 5
\&    #!/bin/sh
\&    /etc/init.d/iptables load work
\&    cp /etc/lockout/sudoers.lock /etc/sudoers
.Ve
.PP
\&\fI/etc/lock/unlock.sh\fR undoes these effects.  For example:
.PP
.Vb 5
\&    #!/bin/sh
\&    /etc/init.d/iptables restart
\&    cp /etc/lockout/sudoers.normal /etc/sudoers
.Ve
.PP
Your \fI/var/lib/iptables/work\fR may look something like this:
.PP
.Vb 4
\&    *filter
\&    :INPUT ACCEPT [1047:99548]
\&    :FORWARD ACCEPT [0:0]
\&    :OUTPUT ACCEPT [1104:120792]
.Ve
.PP
.Vb 7
\&    # allow incoming packets from localhost, ntp,
\&    # and existing connections
\&    -A INPUT -i lo -j ACCEPT
\&    -A INPUT -p udp -m udp --source-port ntp -m state --state ESTABLISHED -j ACCEPT
\&    -A INPUT -m state --state ESTABLISHED -j ACCEPT
\&    -A INPUT -p tcp -j DROP
\&    -A INPUT -p udp -j DROP
.Ve
.PP
.Vb 7
\&    # allow outgoing connections for email and DNS
\&    -A OUTPUT -d 127.0.0.1/8 -j ACCEPT
\&    -A OUTPUT -p tcp -m tcp --dport smtp -j ACCEPT
\&    -A OUTPUT -p tcp -m tcp --dport domain -j ACCEPT
\&    -A OUTPUT -p udp -m udp --dport domain -j ACCEPT
\&    -A OUTPUT -j DROP
\&    COMMIT
.Ve
.SH "EXAMPLES"
.IX Header "EXAMPLES"
.Vb 5
\&    lockout lock 2h30m   [locks out for 2h and 30m]
\&    lockout lock 90m     [locks out for 1h and 30m]
\&    lockout lock 3pm     [locks out until 3pm]
\&    lockout lock 3:20am  [locks out until 3:20am]
\&    lockout lock 15:20   [locks out until 3:20pm]
.Ve
.PP
.Vb 1
\&    lockout status       [shows when the system is going to be unlocked]
.Ve
.SH "FILES"
.IX Header "FILES"
\&\fI/etc/lockout/lock.sh\fR: executed when running \fBlockout lock\fR
.PP
\&\fI/etc/lockout/unlock.sh\fR: executed when running \fBlockout unlock\fR
.SH "SEE ALSO"
.IX Header "SEE ALSO"
\&\fIusermod\fR\|(8), \fIiptables\fR\|(8), \fIpasswd\fR\|(1), \fIcron\fR\|(8), \fIcrontab\fR\|(1)
.SH "BUGS"
.IX Header "BUGS"
Arguably, a program that changes the root password to something random with
the possibility of never recovering the original password might be considered
a bug by itself.  Other than that, no known bugs.
.SH "AUTHOR"
.IX Header "AUTHOR"
Thomer M. Gil, http://thomer.com/lockout/