8

I have problem with "MaxSessions" parameter in sshd.

I would like to restrict number of sessions via one ssh connection. For example for tcp forwarding.
When I set MaxSessions to 0, logons are not working (thats fine, thats how it should work) but when I set to 1 I can have multiple sessions (even 1 disables multiplexing) via one ssh connection and set it to 2 or more has no effect as well then.
Maybe you can direct me to right solution.

I test it like this: Open ssh connection from putty (win) to server(BSD). Port forwarding is in use (for http). So I use SOCKS in browser.
I download two files simultaneously from two different websites and it works for both through this tunnel but it should not (MaxSessions is set to 1).

  • sshd - OpenSSH 5.2 portable for FreeBSD
  • OS - FBSD 6.2

Thank you for any help.

Improve this question
  • Check at the ssh server network connection status to see how much and how is created, maybe since it from one browser it count as one. – Hanan N. Dec 6 '11 at 12:21
  • Since they're going over the same tunnel, it probably only counts as one connection. Open a second putty window and try connecting with that one too – Kevin Dec 6 '11 at 14:06
  • 1 Login = 1 Session, 1 Tunnel = 1 Session, 1 Tunnel can tunnel a multitude of traffic from and to various and multiple sources and being 1 tunnel = 1 session. – Tim Dec 6 '11 at 15:16
15

From sshd_config(5)

MaxSessions Specifies the maximum number of open sessions permitted per network connection. The default is 10.

This man entry for this particular limit is somewhat vague. The change log message adding this feature is a bit more helpful:

Added a MaxSessions option to sshd_config(5) to allow control of the number of multiplexed sessions supported over a single TCP connection. This allows increasing the number of allowed sessions above the previous default of 10, disabling connection multiplexing (MaxSessions=1) or disallowing login/shell/subsystem sessions entirely (MaxSessions=0).

Effectively, the MaxSessions parameter is meant to limit the number of multiplexed ssh sessions you can have over a single ssh session. See the ControlMaster section of ssh_config(5).

Session multiplexing allows you to setup a single Master connection which all other connections to the same host can then reuse (but they don't have to). This has no effect on port forwarding, or SOCKS proxying. It also has no effect on my ability to connect again to the same host via a new network connection. It is really specific to connection multiplexing, and nothing more.

Improve this answer
11

Just as a side note for people that hit this thread looking for general information on restricting concurrent connections:

If you want to limit the number of concurrent logins a user can have over ssh, you can adjust limits.conf

/etc/security/limits.conf:

foo-user           -       maxlogins       1

You can limit the number of sessions in sshd_config to prevent the use of ControlMaster auto in ~/.ssh/config

/etc/ssh/sshd_config:

MaxSessions 1

And then sudo service ssh restart or perhaps sudo reboot

Improve this answer
2

For those of you using chef, adding MaxSessions 1 to /etc/ssh/sshd_config will break knife ssh as it seems to rely on multiplexing. If anyone has a workaround for this, I'd love to hear it!!! (adding MaxSessions 1 and NOT breaking chef, that is...).

NOTE: For above ^^^ You'll see errors like:

  • ERROR: IOError: closed stream
  • ERROR: Net::SSH::Disconnect: connection closed by remote host
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.