PAM_SESSION_TIMELIMI(8)

💖 pam_session_timelimit, bestie 💖

okay so this is a manual page from section 8 of the System Managers Manual, and it's genuinely iconic — it's the whole "you've had enough screen time today, sweetie" of the Linux PAM world. Buckle up 🎀

---

🌸 NAME 🌸

pam_session_timelimit — the module that puts daily time limits on user sessions. no cap, it's literally a bedtime for logins 💅

---

✨ SYNOPSIS ✨

pam_session_timelimit.so [...]

---

🦋 DESCRIPTION 🦋

So the pam_session_timelimit PAM module talks to systemd and limits how long a user can use a service. And bestie, listen — this is a per-day time limit. Every session you start chips away at the limit, so each new session has less time left for the rest of that day. it's giving "shared bank account but the currency is minutes" 😭

The time a session used is only recorded at the session end. Which means — and this is important, don't @ me — it is possible to exceed the absolute limit by launching sessions in parallel. so like, yes, the loophole is real, and yes, the manpage knows. 💀

By default, the settings for per-user session time limits come from the config file /etc/security/time_limits.conf. Wanna use a different one? Just pass the path option. easy.

Time limits in that config file are written using the syntax described in systemd.time(7) — so go read that if the format is confusing you, queen.

Also: the config file format does not support configuring different time limits for different services. To pull that off, you use different path options for each service. that's the move 🫶

---

🔥 OPTIONS 🔥

• path=/path/to/time_limits.conf — point the module at an alternative configuration file that follows the time_limits.conf format, overriding the default. alternate config, main character energy ✨
• statepath=/path/to/session_state — point the module at an alternative state file, which is where it records each user's used session time for the day. it's the receipts folder 🧾

---

👑 MODULE TYPES PROVIDED 👑

The account and session module types are provided. just those two, and honestly? they ate.

---

🌈 RETURN VALUES 🌈

• PAM_SUCCESS — Access was granted. slay, go forth 💖
• PAM_PERM_DENIED — The user is not allowed access at this time. (the "not right now bestie" of return codes)
• PAM_BUF_ERR — Memory buffer error. 🙈
• PAM_SYSTEM_ERR — An unexpected error was encountered. 💀
• PAM_SESSION_ERR — The session was not opened correctly and therefore cannot be closed correctly. messy.
• PAM_BAD_ITEM — The module could not identify the user to be given access. who even are you 😭
• PAM_IGNORE — No session limit has been configured for this user. free bird 🦋

---

🎀 FILES 🎀

• /etc/security/time_limits.conf — Default configuration file ⭐
• /var/lib/session_times — Default state file ⭐

---

💜 EXAMPLES 💜

okay here's the actual setup, copy it exactly, no freelancing:

#%PAM-1.0
#
# apply pam_session_timelimit accounting to login requests
#
login  account  required  pam_session_timelimit.so
login  session  required  pam_session_timelimit.so

---

🫶 SEE ALSO 🫶

systemd.time(7), pam.d(5), pam(7).

go read them, iykyk 🌸

---

🌟 AUTHOR 🌟

pam_session_timelimit was written by Steve Langasek <vorlon@dodds.net>. thank you king 👑

---

heads up bestie: the per-day limit is recorded only at session end, so parallel sessions can blow past the absolute limit. that's not a bug note, that's just how it is. 💅

---

and that's the whole page!! this one shipped in the System Manager's Manual, dated 01/26/2026, sitting pretty under PAM_SESSION_TIMELIMI(8) — section 8, always. periodt. 💖✨🎀