2

is it possible to limit number of processes for a given group or user using the process name? Eg. I'd like to groups remotes have only 5 simultaneous ssh processes that are run on my server. I don't see any options in pam_limit (I can only limit number of process per user or group, regardless of process name) and I don't see ability in cgroups.

Do you have any ideas how to accomplish this? (script in cron is not an answer for me :))

  • isn't it possible to create a unique group for each user, so you could limit them? – user55518 Apr 4 '14 at 16:42
  • ssh through xinetd might be of help here – phoops Apr 4 '14 at 18:57
2

No, it is not possible to limit by process name, because the process name can be changed easily.

So that limit could easily be evaded.

(It can even be changed at runtime I think.)

| improve this answer | |
  • The arguments can be modified definitely, and the command name can be changed via exec. see man ps and look for the comm or -c format specifier. – mikeserv Apr 5 '14 at 12:00
3

While I don't know of a way to limit the number of processes by name, you may be able to accomplish your overall goal via pam_limits by limiting the number of user logins.

An entry in /etc/security/limits such as

@remotes         hard    maxlogins       5

will ensure that the users of the remotes group cannot have more than 5 login sessions on the system. You may want to pair this with MaxSessions=1 in your sshd_config (to prevent multiplexed SSH sessions).

Another option would be to run the sshd service under a service supervisor, init system, or superserver that allows you to limit the instances of the services that it starts. edvinas.me mentioned xinetd. If you were running sshd under xinetd, the completely untested xinetd config fragment below would limit your total number of ssh instances to 20:

service ssh
{
        socket_type     = stream
        protocol        = tcp
        wait            = no
        user            = root
        server          = /usr/sbin/sshd
        server_args     = -i
        per_source      = UNLIMITED
        instances       = 20
}

A similar effect could be obtained by using a systemd socket unit with MaxConnections=20.

| improve this answer | |
  • ssh was only an example. Instead we could say it is a vim editor. – Artur Szymczak Apr 6 '14 at 7:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.