1

Debian 8.0, pam 1.1.8-3.1, sshd 1:6.7p1-5.

I'm trying to permanently increase the maximum number of open files.

In /etc/pam.d/ I've got:

/etc/pam.d# grep pam_limits.so *
atd:session    required   pam_limits.so
common-session:session required pam_limits.so
common-session-noninteractive:session required pam_limits.so
cron:session    required   pam_limits.so
login:session    required   pam_limits.so
runuser:session         required        pam_limits.so
sshd:session    required     pam_limits.so
su:session    required   pam_limits.so         

In /etc/security/limits.conf:

*       hard    nofile  20000500
*       soft    nofile  20000500         

In /etc/ssh/sshd_config:

UsePAM yes

In /etc/sysctl.conf:

fs.file-max = 20000500

I've rebooted the OS and what I'm seeing in /var/log/auth.log is:

sshd[807]: pam_limits(sshd:session): Could not set limit for 'nofile' to soft=20000500, hard=20000500: Operation not permitted; uid=0,euid=0

Same thing trying to do ulimit -Hn 20000500 as root:

bash: ulimit: open files: cannot modify limit: Operation not permitted

Using trial-and-error, I've found the maximum number I can give ulimit -Hn without failing: 1048576. Why exactly this number and where does it come from?

P.S. When it says "operation not permitted", how do I know who decides? I assume the code within pam_limits.so is trying to set the limits, but who does actually refuse? Is it the PAM system which possibly takes over the whole security system in the OS?

2

Is no a recommend, I would like to say, you cannot do that. if you looking this other answer.

can't log in when nofile is set to unlimited in /etc/security/limits.conf

man proc

   /proc/sys/fs/file-max
          This file defines a system-wide limit on the number of open files for all processes.  (See also setrlimit(2), which can be used by a process to set the per-
          process  limit,  RLIMIT_NOFILE,  on the number of files it may open.)  If you get lots of error messages in the kernel log about running out of file handles
          (look for "VFS: file-max limit <number> reached"), try increasing this value:

              echo 100000 > /proc/sys/fs/file-max

          The kernel constant NR_OPEN imposes an upper limit on the value that may be placed in file-max.

          If you increase /proc/sys/fs/file-max, be sure to increase /proc/sys/fs/inode-max to 3-4 times the new value of /proc/sys/fs/file-max, or you will  run  out
          of inodes.

          Privileged processes (CAP_SYS_ADMIN) can override the file-max limit.

ulimit is a limit for a user, isn't normale set the same number in the global setting, is like a user can use all files in the system.

2

Nothing hardcoded, simply set sysctl_nr_open via fs.nr_open=5242880 and re-do sysctl -p/login, your limit is now 5m. file-max needs to be the same value.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.