Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have ssh set up so my users can only access sftp and port forwarding, how can I limit the number of concurrent logins on a per user basis?

In my sshd_config file, I have UsePAM set to yes, and in /etc/security/limits.conf file, I have:

username             -       maxlogins       1

I also tried:

username             hard    maxlogins       1

Neither of these works and the users can still log in multiple times.

share|improve this question
add comment

3 Answers

up vote 0 down vote accepted

Surprisingly, the maxlogins directly only applies to shell logins, i.e. ones handled by sshd. (Secure SHell). Since you are interested in SFTP / portforwarding, you'll have to use something else.

You can modify the script given at this related question to detect sftpserver processes, or scponly. It should also work for detecting excessive port forwarding. Unfortunately it's not as clean as a simple directive.

Script: How can I disconnect ssh users, or limit the number of ssh logins?

share|improve this answer
add comment

Are you testing it with root (uid 0) "username" by any chance?

maxlogins
maximum number of logins for this user except for this with uid=0
share|improve this answer
    
No I'm testing with ordinary user. –  Kyoku Apr 8 '12 at 19:23
add comment

Do you use pam_limits in your PAM for this?

In /etc/pam.d/sshd:

 session    required     pam_limits.so
share|improve this answer
    
I just checked, yes that's in there. The limit works if the user logs into a shell but not if they are using SFTP / Port Forwarding only. –  Kyoku Apr 9 '12 at 15:05
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.