5

How can I limit the number of desktop machines, within a private, all-Linux LDAP-authenticated network, that a single user account is logged in to at one time?

Here is the scenario to prevent: A user with a valid account logs in on that same account to 10 different desktops so that he can play games with his 9 friends; none of those friends have valid accounts on the network.

The server is RHEL 5 with OpenLDAP, desktops are Fedora 11 (will be CentOS 5.4 when available). All desktop logins are via LDAP on the server.

Note: Limiting concurrent logins on a single machine can be done with maxlogins in /etc/security/limits.conf, but this is useless in the stated scenario.

Also note: On a Windows network with Active Directory, software such as UserLock and LimitLogin can accomplish this; but this network has no Windows and no AD server.

EDIT: I realize LDAP can't do this by itself; if there is a mature, well-tested add-on product, similar to the aforementioned Windows-based products, then that would be good news. I will even consider non-gratis/non-libre solutions.

5
  • 1
    This is especially tricky in a true multi-user OS like Linux where some users may want to take advantage of multiple ttys (i.e. ALT-F1, ALT-F2 in text mode).
    – Kyle Smith
    Oct 21, 2009 at 21:20
  • 2
    ...there are multiplayer games in Linux? Oct 22, 2009 at 12:57
  • @David: lokigames.com/products/ut ... but it was just an example; account-sharing for any reason should be prevented. Oct 22, 2009 at 18:02
  • @DavidMackintosh: If you have a new question, ask it on a new page (most likely not on serverfault in this case). Don't hijack the existing thread. ;-)
    – mc0e
    Apr 5, 2016 at 13:00
  • @mc0e: nothing like getting your wrists slapped SIX AND A HALF YEARS after the fact. :) Apr 5, 2016 at 15:02

1 Answer 1

3

After searching it doesn't look like LDAP or Kerberos will do this. Apparently there is no attribute for it in LDAP and there really is no way for it to work from an LDAP perspective. There's no logout from LDAP, so it would never be able to decrement the login count.

Given this, it appears that the solution will have to be ad hoc.

You'll need a service that monitors /var/run/utmp or the command w (shows users currently logged in) on each machine and reports it to a central server by some mechanism (nfs mount + text file, for example).

Then, you'll need a login script that kicks the user out if they've exceeded the limit of concurrent logins. The login script would read from the central server what the current login count is. Alternatively, you could have a service that modifies the maxlogins in /etc/security/limits.conf based on the value of the login count retrieved from the central server.

maxlogins = $total_logins - $current_logins

Basically, the most important consideration is that the users don't have permission to change the login count themselves or they could just manually change the value to allow more logins.

1
  • Swoogan: Thanks for looking and for the detailed recommendations; that's about where I'd ended up before asking here. I'll leave the question open for a bit longer, though, in case somebody has a better idea. Oct 22, 2009 at 18:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .