Would this be best done through PAM?
closed as not a real question by Lucas Kauffman, voretaq7♦ Jul 28 '12 at 4:44
It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, see the FAQ.
You can do this in many ways. You can limit how many times a user can connect via SSH by using the pam_tally (better pam_tally2) module with something like
which limits every user to 10 logins / minute.
This is of course not blocking the connection to the SSH daemon in any way. To do that you should use netfilter and the recent module
Which limits every host (regardless of a succesful or unsuccesful login) to 10 connections every 20 seconds.
You can make PAM reset the iptables counter by writing a script (executed by pam_exec.so) which does echo "-IPaddress" > /proc/net/xt_recent/nameoftherecentlist or add an untrusted host doing the same but with echo "+IPaddress" > ...
More information can be found at: http://www.kernel.org/pub/linux/libs/pam/Linux-PAM-html/sag-pam_tally.html and http://www.debian-administration.org/articles/187 and of course with the man command.
I think PAM is the answer here, that's typically where you put any kind of system-wide authentication hooks.
I don't know of any existing PAM module that does what you want, but there is a module called pam_exec which lets you use an external script. You could write a script that accepts / rejects users on whatever criteria. This is definitely far easier than trying to implement your own module in C.
For this particular case your script can parse the output of
Another slightly bizarre way, admittedly, could be to run a script in
You could do this via a sufficiently capable external load-balancer, something like a Zeus ZXTM, Cisco ACE or perhaps a Brocade/Foundry ServerIron.
Open-SSH sshd_config provides a variable to limit the number of concurrent unauthenticated connections alive... (MaxStartups) http://unixhelp.ed.ac.uk/CGI/man-cgi?sshd_config
But I assume you mean max number of open connections??
Ok assuming it is just the no of connections in a day you could do this in a cron job
if [ $ssh_sess_count -gt 10]
Of course this assumes your settings for logrotate are to keep a logfile per day basis. And you will have to change the count and service name(depending on your box)
Now that should get me the 50 points huh??