2

I have ssh set up so my users can only access sftp and port forwarding, how can I limit the number of concurrent logins on a per user basis?

In my sshd_config file, I have UsePAM set to yes, and in /etc/security/limits.conf file, I have:

username             -       maxlogins       1

I also tried:

username             hard    maxlogins       1

Neither of these works and the users can still log in multiple times.

2
  • Are you testing it with root (uid 0) "username" by any chance? maxlogins maximum number of logins for this user except for this with uid=0
    – Piotr
    Apr 8, 2012 at 19:18
  • No I'm testing with ordinary user.
    – Kyoku
    Apr 8, 2012 at 19:23

3 Answers 3

1

Surprisingly, the maxlogins directly only applies to shell logins, i.e. ones handled by sshd. (Secure SHell). Since you are interested in SFTP / portforwarding, you'll have to use something else.

You can modify the script given at this related question to detect sftpserver processes, or scponly. It should also work for detecting excessive port forwarding. Unfortunately it's not as clean as a simple directive.

Script: How can I disconnect ssh users, or limit the number of ssh logins?

0

Do you use pam_limits in your PAM for this?

In /etc/pam.d/sshd:

 session    required     pam_limits.so
1
  • I just checked, yes that's in there. The limit works if the user logs into a shell but not if they are using SFTP / Port Forwarding only.
    – Kyoku
    Apr 9, 2012 at 15:05
-1

You can try the MaxSessions option in _/etc/ssh/sshd_config_.
man sshd_config

1
  • no no no no no no
    – Jakuje
    Feb 26, 2020 at 7:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .