11

I landed up in a situation wherein I had to access a Linux machine via puTTY.I made various attempts to SSH but failed to connect to the machine. I then realised my colleague was accessing the same Linux machine as root user,and I too wanted to access as a root user.I asked him to log out so that I can login as root. Is there a way we limit number of SSH login on a linux OS? Is this some kind of security feature that distinguishes a windows based OS with a linux based OS.

  • 1
    Are you saying that you could login as root once he logged out? And you want to know how or where this limit might be set? – Matt Apr 29 '14 at 11:43
  • yes i am able to login as root once he logged out – turmoilawaits Apr 29 '14 at 12:15
7

Yes it is possible to limit the number of concurrent login sessions, although most Linux distributions do not impose such limits in their default settings.

Linux is proper multi-user system by design and normally you shouldn't have any problems with having multiple concurrent SSH sessions for the same user.

The SSH server can impose such limits with the MaxSessions option in the configuration file. Through PAM you can impose such limits as well as others have already pointed out.

  • I am using Cent OS 6.4. Does it limit concurrent SSH sessions ? – turmoilawaits Apr 29 '14 at 12:23
  • Not by default. – HBruijn Apr 29 '14 at 12:31
6

You probably have limits set in /etc/security/limits.conf like so

root hard maxlogins 1

Change the limit (1) to something higher if needed.

  • This setting does not affect concurrent SSH logins on Centos6 – bbaassssiiee Sep 30 '14 at 11:46
2

Trying to convince a standalone sshd daemon to limit the number of sessions is fraught with loopholes. Things like MaxSessions limit something other than what the OP is talking about. And sshd ignores limits.conf on linux (similarly login.conf on FreeBSD) unless you configure things properly to route all incoming sessions through PAM and use the appropriately configured PAM module to check things like limits.conf first. It's hard to get it working right.

On the other hand, if you don't start sshd as a standalone daemon, then you can use the limiting features in the "thing" that spawns sshd on demand.

For instance, inetd and xinetd have a connection limiting feature (that usually defaults to not enforcing any limit to the number of forked children). In classic inetd, it's called "max-child". With xinetd, look for the instances configuration knob. For example, inetd style:

ssh  stream  tcp  nowait/3  root  /usr/sbin/sshd  sshd -i -4

That limits the number of concurrent ssh connections to 3.

For those who are so inclined, systemd can replace the function of inetd, and I believe there is a way to limit the number of instances of a service. Exercise left to the reader (or add a comment with the details!).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.