0

I'm trying to set up default disk quotas for every new user that gets an account created in my Debian10 server.

For example, user1 gets an account created and the first time he logs in the system (through ssh or su or whatever) his account gets a 100MB disk quota hard limit without the manual intervention of the server admin.

I've made a perl script that lets me set disk quotas for a user but it only works when used by root, which makes sense since a user could modify his own quotas. But is there a way to use it with a pam module maybe so that a user quotas are set up automatically?

Is there another (maybe better) way to set these automatic disk quotas for all the incoming new users?

2
  • why the quota needs to be created on user login? why not setting quota while user creation?
    – binarysta
    Jun 23, 2020 at 15:55
  • User creation is made by running a perl script from a website. I use a perl module to create a user account when the user signs up in the website. This module adds the user to /etc/passwd and /etc/shadow only because it uses Apache's suExec feature. So the server admin doesn't create the user accounts manually. I want to automatise the quotas in a "similar" way but I dont know how.
    – wolfvc
    Jun 23, 2020 at 16:48

1 Answer 1

1

pam_setquota.so

You can use pam_setquota(8). It's meant for exactly this.

You probably already have it installed (under /usr/lib/x86_64-linux-gnu/security/pam_setquota.so) but if not first install it with:

apt install -y libpam-modules

To set a 100MB quota for new users you need to edit your /etc/pam.d/common-session configuration to include this line

session required    pam_setquota.so fs=/home bsoftlimit=102400 bhardlimit=102400

On Debian and derivatives like Ubuntu, there's an extra layer of abstraction that's there to coordinate multiple packages editing these configs called pam-auth-update(8). So what you actually need to do is add this file:

# /usr/share/pam-configs/setquota-home

Name: Set quotas for /home on first log in
Default: no
Priority: 120
Session-Type: Additional
Session-Interactive-Only: no
Session:
    required    pam_setquota.so fs=/home bsoftlimit=102400 bhardlimit=102400

And then recompile the contents of /etc/pam.d with

pam-auth-update --enable setquota-home

or, if you're scripting this like I often am

DEBIAN_FRONTEND=noninteractive pam-auth-update --enable --force setquota-home

If you have multiple partitions to set quotas on, add and enable a separate pam-config for each, setting each fs to the mountpoint of each different partition.

Parameters

bsoftlimit is the threshold that blocks writes not immediately but after a period elapses. If you set a larger bhardlimit, then people may go over their "quota" (aka bsoftlimit) temporarily -- up to 7 days by default -- before being blocked, so long as they don't also go over their "limit" (aka bhardlimit).

bsoftlimit and bhardlimit are given in 1KiB units, so 102400 represents 100MiB. (If you in fact want MB, not MiB, you can set 97657 instead). The manpage says you must set both at once, and since you only asked for a a hard limit I am just setting them to the same value.

You can also set isoftlimit/ihardlimit to control the inode quotas (roughly, how many distinct files are allowed), and again if you set one you must set the other.

If you want to grant an exception for some user, use setquota(8) to raise (or lower) their quota -- and here you can use units of K (for kibibyte), M (for mebibytes), G (for gibibytes) and T (for tebibytes), e.g.:

setquota hazimi 150M 2G 0 0 /home

to undo this, run

setquota hazimi 0 0 0 0 /home

which counts as removing the quota, so that on their next login pam_setquota(8) will reset it.

If you don't want to allow temporary exceptions, there is also an overwrite parameter; if you set it like

required    pam_setquota.so fs=/home overwrite=1 bsoftlimit=102400 bhardlimit=102400

then everyone's quotas are forced to 100MiB on every login.

Quota 101

Setup

You say you already have quotas set up, but for anyone else who finds this and needs a cheat-sheet:

  1. apt install -y quota

  2. Add usrquota to the mount options in your /etc/fstab, for example

    /dev/disk/by-uuid/89fc4b3e-3448-42d8-944d-588b6ec4284e /home ext4 defaults,usrquota 0 0
    

    On Linux there are two other kinds of quotas, "group" (grpquota) and "project" (prjquota) which you could also enable, but these are not managed by pam_setquota(8), so read the manuals if you want to know about those (and to use prjquota read chattr(1)).

  3. Activate the new option:

    mount -o remount /home
    

    (or just reboot)

  4. Confirm the new option took effect:

    # mount | grep home
    /dev/mapper/home on /home type ext4 (rw,relatime,quota,usrquota,stripe=64)
    

    Notice that usrquota will also imply quota.

  5. Use quotacheck to create the initial, special, /home/aquota.user file:

    quotacheck -u -m /home
    

    This will take a while because it will scan the entire partition to count up the current usage; it's like fsck but for quotas.

  6. quotaon /home

    Once quotas are enabled, the kernel will take care of updating /home/aquota.user efficiently, without having to rescan the entire disk, because it can track all writes, without having to rescan the entire disk.

Usage

If your users have shell access, they can see their current quotas in action with quota(1)

$ quota -s --show-mntpoint --hide-device
Disk quotas for user hazimi (uid 1004): 
     Filesystem   space   quota   limit   grace   files   quota   limit   grace
          /home    120G*   100G   1024G   6days    344k       0       0        

As an an admin, you can get an overview of all quotas with repquota(8).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .