Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an ssh server. Some of my users login several times simultaneously; some of those who are doing that should not be, and I suspect account sharing. The ones who shouldn't are all members of a particular unix group.

What I'd like is a way to restrict the number of concurrent logins that members of group 402 can have to "one each", with the most recent login taking precedence.

That last bit is important; these users sometimes legitimately lose their connection to the machine and need to re-establish it, and I don't want them to be locked out of the machine because there's a hanging session which they can't kill. Instead, I want a new authenticated connection attempt to automatically disconnect the old one.

Does anyone do anything like this? Has anyone any clever PAM-based or similar suggestions?

share|improve this question
up vote 4 down vote accepted

Believe you could use /etc/security/limits.conf to enforce this, syntax is:

<domain> <type> <item> <value>

So a working line might looks like:

@402 hard maxlogins 1

As for the lost sessions, could you set a low ClientAliveInterval in sshd to ensure dead sessions don't hang around for too long?

share|improve this answer
This solution also doesn't make the last login displace the first, but provided I can get over my concerns about setting ClientAliveInterval for all the users, this is what I'll be going with. Thanks! – MadHatter Jul 26 '11 at 12:52
And in case anyone comes this way again, CentOS 4 (at least) requires a group name after the @ directive, not a GID. – MadHatter Jul 26 '11 at 12:58

Use MaxSessions directive in sshd_config.

Match Group groupname
MaxSessions 1
ClientAliveInterval 30
ClientAliveCountMax 1

At the end of your file so that values are overriden only for the group groupname (you must use name, not numerical ID). If the client does not respond for more than one message sent every 30s, the client will be disconnected. You can fiddle with numerical values to your satisfaction. Seems to work on my RHEL 6.

share|improve this answer
This solution doesn't make the last login displace the first, but otherwise it's very good. Sadly, it seems that the MaxSessions option was introduced in SSH 5.1, which this server isn't running (and upgrading may be unacceptable). Also, later sshds complain that ClientAliveInterval isn't legal inside a Match block, and I'm not sure I want to set it so low for all users. All around, a good suggestion, though - thank you! – MadHatter Jul 26 '11 at 12:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.