I want to restrict every user on my Centos 7 server who is logged in via SSH. They should not be able to use, for example, a forkbomb and kill the whole system. The superuser will have no restriction.

Restricting a service like httpd is no problem with systemd :

systemctl set-property httpd.service CPUShares=500 MemoryLimit=500M

But how could I get this for each SSH user login session?

I could try to open a new service with:

systemd-run --unit=bashtest --slice=btest bash
then restrict it with set-property.

But I don't know how a user could then log in into this bash session.

  • ok a solution is using ulimit in /etc/security/limits.conf, but how could i reach this with cgroups? – bubele Jun 1 '15 at 14:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.