Limiting ssh connections with a daily amount [closed]

Question

Would this be best done through PAM?

Answer 1

You can do this in many ways. You can limit how many times a user can connect via SSH by using the pam_tally (better pam_tally2) module with something like

auth     required       pam_tally.so deny=10 unlock_time=60 per_user

which limits every user to 10 logins / minute.

This is of course not blocking the connection to the SSH daemon in any way. To do that you should use netfilter and the recent module

iptables -A INPUT -tcp --dport 22 -m state --state NEW -m recent --set
iptables -A INPUT -tcp --dport 22 -m state --state NEW -m recent --update --hitcount 10 --seconds 20 -j DROP

Which limits every host (regardless of a succesful or unsuccesful login) to 10 connections every 20 seconds.

You can make PAM reset the iptables counter by writing a script (executed by pam_exec.so) which does echo "-IPaddress" > /proc/net/xt_recent/nameoftherecentlist or add an untrusted host doing the same but with echo "+IPaddress" > ...

More information can be found at: http://www.kernel.org/pub/linux/libs/pam/Linux-PAM-html/sag-pam_tally.html and http://www.debian-administration.org/articles/187 and of course with the man command.

Answer 2

I think PAM is the answer here, that's typically where you put any kind of system-wide authentication hooks.

I don't know of any existing PAM module that does what you want, but there is a module called pam_exec which lets you use an external script. You could write a script that accepts / rejects users on whatever criteria. This is definitely far easier than trying to implement your own module in C.

For this particular case your script can parse the output of last and count how many times the user has logged in today.

Answer 3

To answer the question you asked:

Would this be best done through PAM?

No.

Answer 4

Another slightly bizarre way, admittedly, could be to run a script in /etc/bash.bashrc or /etc/profile which counts logins in 24hr period and drops them if they exceed a set number. Every time a shell is called by a user it simply increments.

Answer 5

You could do this via a sufficiently capable external load-balancer, something like a Zeus ZXTM, Cisco ACE or perhaps a Brocade/Foundry ServerIron.

Answer 6

Open-SSH sshd_config provides a variable to limit the number of concurrent unauthenticated connections alive... (MaxStartups) http://unixhelp.ed.ac.uk/CGI/man-cgi?sshd_config

But I assume you mean max number of open connections??

Ok assuming it is just the no of connections in a day you could do this in a cron job

export ssh_sess_count=grep 'Accepted password' /var/log/secure | grep sshd |wc -l

if [ $ssh_sess_count -gt 10]

then

service ssh stop

fi

Of course this assumes your settings for logrotate are to keep a logfile per day basis. And you will have to change the count and service name(depending on your box)

Now that should get me the 50 points huh??