0

Currently, I am running into an issue with dropbear. I have set the maximum number of concurrent ssh sessions to 10 but I still able to ssh an 11th sessions. Would you please let me know what I am doing wrong?

cat /proc/sys/kernel/pty/max
10

I am using a 64bit platform.

  • 1
    I'm not sure that limiting the number of pseudo terminals will do what you want. You may have better luck looking at maxsyslogins in /etc/security/limits.conf. See man limits.conf for more information – Tim Kennedy Sep 21 '18 at 13:16
  • I have had no luck with MaxSessions using SLES 11.4; I have it set to 1 and I can have multiple putty ssh terminals connected to my linux server in addition to other users doing the same, at the same time. That being said if you run in to a similar issue with MaxSessions never working you might focus on the version of SSH being implemented. There is also the UsePAM yes in sshd_config as well as PAM itself where you could write up a rule in PAM to enforce what you want... easier said than done unfortunately – ron Sep 24 '18 at 17:20
0

The SSH server can impose such limits with the MaxSessions option in the configuration file. However, according to ssh man

MaxSessions
     Specifies the maximum number of open shell, login or subsystem
     (e.g. sftp) sessions permitted per network connection.  Multiple
     sessions may be established by clients that support connection
     multiplexing.  Setting MaxSessions to 1 will effectively disable
     session multiplexing, whereas setting it to 0 will prevent all
     shell, login and subsystem sessions while still permitting for-
     warding.  The default is 10.

 MaxStartups
     Specifies the maximum number of **concurrent   unauthenticated con-
     nections to the SSH daemon.**  Additional connections will be
     dropped until authentication succeeds or the LoginGraceTime
     expires for a connection.  The default is 10:30:100.

     Alternatively, random early drop can be enabled by specifying the
     three colon separated values ``start:rate:full'' (e.g.
     "10:30:60").  sshd(8) will refuse connection attempts with a
     probability of ``rate/100'' (30%) if there are currently
     ``start'' (10) unauthenticated connections.  The probability
     increases linearly and all connection attempts are refused if the
     number of unauthenticated connections reaches ``full'' (60).

Dropbear implements the complete SSH version 2 protocol in both the client and the server. so, I believe you should run something like this command:

ssh  stream  tcp  nowait/3  root  /usr/sbin/sshd  sshd -i -4

That limits the number of concurrent ssh connections to 3. Adjust as you would like.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.