Time-Boxed Logins on Shared Linux Workstations: PAM, SSSD, and a Session Watchdog

Reservation-based access for AD-joined Linux machines: why GPO and stock PAM modules fall short, the architecture I use, and the edge cases a lab exposed.