Overview
Linux Device Lock is a security feature in Swifteam that allows IT administrators to remotely lock a managed Linux device. When activated, the device displays a lock screen with a custom message and contact information, preventing access until the correct master password (PIN) is entered.
How It Works
When a lock command is issued, the Swifteam agent on the Linux device performs the following steps:
1. Lock Screen Setup
The agent creates a set of scripts that intercept the normal login flow:
Init Script (
start-on-tty): Created in/etc/init.d/, this script switches the device to a specific TTY and launches the master password prompt.Start Script (
start-on-tty.sh): Executes the password check and handles cleanup after successful authentication.Master Password Script (
masterpass.sh): Displays the lock message (e.g., "Your system has been locked by [Admin Name]. You can contact this number: +1-208-507-5466") and prompts the user for the PIN.
2. PAM Configuration
The agent modifies PAM (Pluggable Authentication Modules) configuration files to enforce the master password check before any login session can proceed. This ensures the lock cannot be bypassed through standard login methods.
3. Service Management
The agent supports both major Linux init systems:
systemd: A systemd service is created and enabled to run the lock screen on boot.
SysVinit: An init script is installed and registered for older systems.
SELinux: If SELinux is active, policies are adjusted to allow the lock scripts to execute.
4. Password Verification
When the user enters the PIN at the lock screen:
If incorrect: The system waits 5 seconds, then prompts again.
If correct: The system proceeds to unlock.
5. Unlock & Cleanup
Once the correct PIN is entered (or an unlock command is received from the agent), the device restores itself to its original state:
All lock-related scripts are deleted.
Created services are removed.
PAM configurations are restored to their original state.
The device reboots to return to normal operation.
Triggering a Device Lock
Required parameters:
Parameter | Description |
| Message displayed on the lock screen |
| Contact number shown to the user |
| Master password required to unlock |
| Target device identifier |
Key Points
The lock takes effect immediately and persists across reboots.
The device cannot be used until the correct PIN is entered or an unlock command is sent remotely.
All changes made during locking are fully reversible — no permanent modifications are made to the system.
Both systemd and SysVinit-based distributions are supported.