1

On an Ubuntu desktop, contains several accounts, I want to limit the GUI login number.

At anytime, there should be only one account can login by using local GUI. (The first account must logout before any other else can login. When the computer is locked by an account, the same account can unlock the computer to continue the existing session, but cannot login again to create another session.)

Meanwhile, any account should be able to login by SSH.

I have tried to add * - maxsyslogins 1 to file "/etc/security/limits.conf"

Concurrent GUI login is blocked, but it also completely blocks SSH login.

Is there a way to achieve this goal?

1 Answer 1

1

The easiest way would be to comment out session required pam_limits.so from /etc/pam.d/sshd.

This will skip the limits during an ssh login. Do note that any other limits you specified would also not apply.

An alternate way would be to use pam_exec.so to run a script in the configuration for your GUI which would be present in etc/pam.d directory. You can check whether a user is currently using the GUI and then allow or deny login based on the result. This would allow limits to work across all type of logins in case there are other limits present.

It'll look something like this. The code and changes below are not tested.

#!/bin/bash

if [ $(ls /tmp/.X11-unix/ | wc -l) -gt 0 ]; then
  exit 1
else
  exit 0
fi

Add the below line to the pam configuration for the your GUI.For gnome it is /etc/pam.d/gdm-password. Not sure about the others.

auth [success=ok default=die] pam_exec.so /path/to/script

Check here for more info on PAM.

1
  • It works! Thank you @sajinmp for your help!
    – Eli
    Commented Jan 3, 2023 at 6:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .