1

I need restrict session limit on my OpenSSH server only for one session (one connection). I use Ubuntu Desktop 7.10. Of course Version is old, but I need it for experimental purposes. I tried modify my config file - /etc/ssh/sshd_config two ways:

First I changed:

MaxStartups 1 

but it does not work correctly. I can make many connections still.

Second I changed:

MaxSessions 1 

after restart I get error message:

/etc/ssh/sshd_config: line 71: Bad configuration option: MaxSessions
/etc/ssh/sshd_config: terminating, 1 bad configuration options

I saw to sshd_config MaxSessions parameter and I tried add:

mato - maxlogins 1 

to /etc/security/limits.conf

but it does not work.

I used - http://www.cyberciti.biz/faq/iptables-connection-limits-howto/ too:

/sbin/iptables -A INPUT -p tcp --syn --dport 22 -m connlimit --connlimit-above 1 -j REJECT, 

but I get error message:

iptables: No chain/target/match by that name

1 Answer 1

0

http://www.openssh.com/txt/release-5.1

The MaxSessions option was implemented on the version 5.1 of OpenSSH. Ubuntu 7.10 uses the version 4.6 so, this option will not be available to you. http://www.ubuntu.com/usn/usn-612-2/

Possible solutions:

  • Download a newer version of OpenSSH and comple it
  • Make a "apt-pinning" and install a newer version of it

What about if you put the following option on your limits.conf?

user hard    maxlogins       1

Since your ar using a pretty old piece of software, a lot of OpenSSH options and iptables modules could not be available to help you on this task

10
  • Thanks. I tried install newer version, but it is story without end because it depends on the a lot of packages that do not compatibile and etc... I tried add user hard maxlogins 1 too, but it does not help me. I don´t understand because it does not restrict number of logins... I am going try apt-pinning...
    – Mato
    Commented Nov 19, 2013 at 16:31
  • I tried jaqque.sbih.org/kplug/apt-pinning.html, but it does not work in my case. :-(
    – Mato
    Commented Nov 19, 2013 at 16:46
  • In this case, your pam + ssh solution could be bugged too. Reference: lists.fedorahosted.org/pipermail/pam-developers/2012-June/… - lists.fedorahosted.org/pipermail/pam-developers/2012-June/… - The second option is that your SSH need a fine tunning to work correctly with pam(ex: tech.kaotix.dk/?p=89). Needless to say that the version your are using could have limitations due to the old verson ;)
    – user34720
    Commented Nov 20, 2013 at 17:29
  • Thank you very much, I have used tech.kaotix.dk/?p=89. For user mato it works correctly (it allow only one SSH session), but for user root - I can connect with many sessions still. My limits.conf - pastebin.com/2ZCSjzZ9. Can you help me please with user root too?
    – Mato
    Commented Nov 25, 2013 at 23:04
  • 1
    ok :-) This system will work as honeypot. I have done your recommendations and I will wait for final result. Thank you.
    – Mato
    Commented Dec 9, 2013 at 21:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .