I need restrict session limit on my OpenSSH server only for one session (one connection). I use Ubuntu Desktop 7.10. Of course Version is old, but I need it for experimental purposes. I tried modify my config file - /etc/ssh/sshd_config two ways:

First I changed:

MaxStartups 1 

but it does not work correctly. I can make many connections still.

Second I changed:

MaxSessions 1 

after restart I get error message:

/etc/ssh/sshd_config: line 71: Bad configuration option: MaxSessions
/etc/ssh/sshd_config: terminating, 1 bad configuration options

I saw to sshd_config MaxSessions parameter and I tried add:

mato - maxlogins 1 

to /etc/security/limits.conf

but it does not work.

I used - http://www.cyberciti.biz/faq/iptables-connection-limits-howto/ too:

/sbin/iptables -A INPUT -p tcp --syn --dport 22 -m connlimit --connlimit-above 1 -j REJECT, 

but I get error message:

iptables: No chain/target/match by that name


The MaxSessions option was implemented on the version 5.1 of OpenSSH. Ubuntu 7.10 uses the version 4.6 so, this option will not be available to you. http://www.ubuntu.com/usn/usn-612-2/

Possible solutions:

  • Download a newer version of OpenSSH and comple it
  • Make a "apt-pinning" and install a newer version of it

What about if you put the following option on your limits.conf?

user hard    maxlogins       1

Since your ar using a pretty old piece of software, a lot of OpenSSH options and iptables modules could not be available to help you on this task

| improve this answer | |
  • Thanks. I tried install newer version, but it is story without end because it depends on the a lot of packages that do not compatibile and etc... I tried add user hard maxlogins 1 too, but it does not help me. I don´t understand because it does not restrict number of logins... I am going try apt-pinning... – Mato Nov 19 '13 at 16:31
  • I tried jaqque.sbih.org/kplug/apt-pinning.html, but it does not work in my case. :-( – Mato Nov 19 '13 at 16:46
  • In this case, your pam + ssh solution could be bugged too. Reference: lists.fedorahosted.org/pipermail/pam-developers/2012-June/… - lists.fedorahosted.org/pipermail/pam-developers/2012-June/… - The second option is that your SSH need a fine tunning to work correctly with pam(ex: tech.kaotix.dk/?p=89). Needless to say that the version your are using could have limitations due to the old verson ;) – user34720 Nov 20 '13 at 17:29
  • Thank you very much, I have used tech.kaotix.dk/?p=89. For user mato it works correctly (it allow only one SSH session), but for user root - I can connect with many sessions still. My limits.conf - pastebin.com/2ZCSjzZ9. Can you help me please with user root too? – Mato Nov 25 '13 at 23:04
  • 1
    ok :-) This system will work as honeypot. I have done your recommendations and I will wait for final result. Thank you. – Mato Dec 9 '13 at 21:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.