I have an ssh server. Some of my users login several times simultaneously; some of those who are doing that should not be, and I suspect account sharing. The ones who shouldn't are all members of a particular unix group.
What I'd like is a way to restrict the number of concurrent logins that members of group 402 can have to "one each", with the most recent login taking precedence.
That last bit is important; these users sometimes legitimately lose their connection to the machine and need to re-establish it, and I don't want them to be locked out of the machine because there's a hanging session which they can't kill. Instead, I want a new authenticated connection attempt to automatically disconnect the old one.
Does anyone do anything like this? Has anyone any clever PAM-based or similar suggestions?