I have ssh set up so my users can only access sftp and port forwarding, how can I limit the number of concurrent logins on a per user basis?

In my sshd_config file, I have UsePAM set to yes, and in /etc/security/limits.conf file, I have:

username             -       maxlogins       1

I also tried:

username             hard    maxlogins       1

Neither of these works and the users can still log in multiple times.


Surprisingly, the maxlogins directly only applies to shell logins, i.e. ones handled by sshd. (Secure SHell). Since you are interested in SFTP / portforwarding, you'll have to use something else.

You can modify the script given at this related question to detect sftpserver processes, or scponly. It should also work for detecting excessive port forwarding. Unfortunately it's not as clean as a simple directive.

Script: How can I disconnect ssh users, or limit the number of ssh logins?


Are you testing it with root (uid 0) "username" by any chance?

maximum number of logins for this user except for this with uid=0
  • No I'm testing with ordinary user. – Kyoku Apr 8 '12 at 19:23

Do you use pam_limits in your PAM for this?

In /etc/pam.d/sshd:

 session    required     pam_limits.so
  • I just checked, yes that's in there. The limit works if the user logs into a shell but not if they are using SFTP / Port Forwarding only. – Kyoku Apr 9 '12 at 15:05

You can try the MaxSessions option in _/etc/ssh/sshd_config_.
man sshd_config

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.