Permit number of connection from same user on SSH

Panagiotis_IOA · 07-31-2007, 05:38 AM

Hi all,

As the title says I want each user to be able to login only once by using ssh. If he/she is already logged in then he/she shouldn't be able to login again.
Is there an entry for this in sshd_config or do I need to do it with iptables?

Thanks in advance!

blackhole54 · 08-01-2007, 11:56 AM

Quote:

Originally Posted by Panagiotis_IOA

Is there an entry for this in sshd_config or do I need to do it with iptables?

I don't think there is a parameter in sshd_config, and frankly, I don't know how you would do it with iptables. (If you can clue me in, I'm all ears!

)

If the login shell for all of your users is bash, then you could edit /etc/profile so that if a user is already logged in, it immediately dumps them back out. (Make sure it's not the current login you are seeing!) I am not sure how to check that the existing login is via ssh, but there is probably a way.

ramram29 · 08-01-2007, 11:58 AM

You can do it through pam.

Panagiotis_IOA · 08-01-2007, 05:18 PM

Quote:

Originally Posted by blackhole54

I don't think there is a parameter in sshd_config, and frankly, I don't know how you would do it with iptables. (If you can clue me in, I'm all ears!

)

The only way with iptables I can think of is by blocking two connections on port 22, or whatever else port sshd may listening to, but this wouldn't allow another user from the same IP to login with a different account.

Quote:

Originally Posted by blackhole54

If the login shell for all of your users is bash, then you could edit /etc/profile so that if a user is already logged in, it immediately dumps them back out. (Make sure it's not the current login you are seeing!) I am not sure how to check that the existing login is via ssh, but there is probably a way.

Hm... I wasn't aware of that. Will try to find something out.

Quote:

Originally Posted by ramram29

You can do it through pam.

I haven't used pam before to be honest. It would be a good opportunity to do it now but then I think that it'll get more complex than what I was excepting to do. Thanks anyway

ramram29 · 08-02-2007, 01:39 PM

The only way you'll be able to specify connection limits is through pam. It's weird to understand at first but once you get it then it'll stick in your brain forever.

Panagiotis_IOA · 08-03-2007, 09:55 AM

Quote:

Originally Posted by ramram29

The only way you'll be able to specify connection limits is through pam. It's weird to understand at first but once you get it then it'll stick in your brain forever.

Thanks for the information