kbdlock − a simple secure Linux console locker.


kbdlock [−cpq] [−c] [−i FILE] [−s TIME] [−t TIME] [−−clear]
[−−password] [−−sleep TIME] [−−timeout TIME] [−−quiet]

kbdlock [−h] [−−help] [−v] [−−version]


Kbdlock locks the Linux text console for the current user. While the console is locked, switching to another virtual consoles is disabled. The console remains locked until the user enters his password.

To be able to use kbdlock you must be a member of the kbdlock group. When you run kbdlock without arguments, it locks your screen for an indefinite interval with your system account password. Use the −t (−−timeout) option to specify the amount of time after which the program should unlock the screen. The argument to this option is a time specification containing at least one and at most three parts. Each part consists of decimal number and a unit suffix. Valid unit suffixes are: h or H for hours, m or M for minutes and s or S for seconds. Thus, running:

kbdlock -t 2h30m

locks the screen for at most two hours and a half.

You may also specify a password that differs from your system one. To do so, use the −p (−−password) option. In this case, kbdlock will ask you to enter the new password twice to prevent any possible errors.

When kbdlock starts up it displays the content of the /etc/issues file followed by the password prompt of the form:

tty is locked by username

If the −t (−−timeout) option is used, the timeout information is included in the prompt.

If kbdlock is linked with the curses library, the −c (−−clear) option can be used to request clearing the screen prior to that.

To display other file than /etc/issues, use the −i (−−issue) option followed by the name of the file to use. If the issue file does not exist or is not readable, kbdlock will silently ignore it.

If you wish to clear the screen and not display anything but the password prompt, use:

kbdlock -c -i /dev/null

To disable printing the prompt, use the −q (−−quiet) option. Notice that this can be confusing.

To discourage brute force attacks, kbdlock waits 3 seconds after each invalid password input. This interval can be configured using the −s (−−sleep) option.


−c, −−clear

Clear screen before displaying the issue and prompt.

−i FILE, −−issue=FILE

Prior to printing the prompt, output the content of FILE. By default, /etc/issue is displayed. To suppress the output, use -i /dev/null. If FILE does not exist or is unreadable, kbdlock will silently ignore it.

−p, −−password

Prompt for password to use, instead of the password of the current user.

−s TIME, −−sleep=TIME

Sleep TIME seconds after each wrong password. See the DESCRIPTION section above for another formats of the TIME argument. Default TIME is 3 seconds.

−t, −−timeout=TIME

Unlock the screen automatically after TIME seconds. See the DESCRIPTION section above for another formats of the argument.

−q, −−quiet

Be very quiet: do not display anything before querying for the password. The use of this option can be confusing to the user.

−h, −−help

Display a short help summary and exit.

−v, −−version

Display program version and license terms.



Default issue file.


Sergey Poznyakoff


Report bugs to <gray@gnu.org.ua>.