Why should I set a maxlogins limit in /etc/security/limits.conf? In other words, are there any performance-related and security-related benefits to be gained?

I have only three users on my machine, but on many days one of the users ends up with more than 15 active sessions. They also love to use tmux, and every split window in tmux counts as one session in the output of w (or who). But I do see that for what they do, they need to have many sessions active at the same time (they run several tasks simultaneously and write codes in another windows at the same time and monitor htop in other windows).

Is there any reason why I should limit the number of logins for this particular user (or even all users) to, say, 5 or 10? Why and why not?

I doubt there'd be any performance-related gain from such practice, but I am eager to know why maxlogins matters.

3 Answers 3


This was an argument for adding a limit to the Oracle security guidelines (and would be applicable to all systems):

Limiting simultaneous user logins can insulate the system from denial of service problems caused by excessive logins. Automated login processes operating improperly or maliciously may result in an exceptional number of simultaneous login sessions.

From Oracle Linux 6 Security Technical Implementation Guide Rule IDSV-65325r2_rule


On a shared system a low maxlogins may help prevent any one user from using a disproportionate share of the limited resources. This will make the system more available to other users (because there are pty, memory, etc still available to them) at the cost of putting a damper on power users (who may instead need their own dedicated system, but this is not a new debate).

For example, a bad power user could write something buggy that consumes all ptys and prevents other users from logging in; with a maxlogins set their buggy script would be less likely to tragedize the commons. This is less of a concern where everyone has their own individual desktop they are free to use as they see fit (unless said desktop does something naughty to the shared network...) but can be critical where are, say, large numbers of students share the use a single server.


My first thought would be that if you were in a security conscious environment, you may want to limit logins within reasonable and understandable levels, for example, if you know that someone on average only logs in 3 times a day, then a day when they login 10 times is unusual, and an outlier. So this could indicate suspicious activity from their login.

I know that there are many systems people are building within cloud environments where API usage is tracked and averaged over time periods, and once an upper limit in API usage is breached (outside of their normal usage) they are locked out of the account/heavily restricted until an admin can verify that nothing strange is going on.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .