(debian) etc/security/limits.conf maxlogins

jakep219 · 04-29-2015, 08:35 AM

My goal is to limit the root user to one login on the system.
I appended a line to /etc/security/limits.conf file

Code:

root - maxlogins 1

After a reboot, I am still able to have multiple simultanious root users logged in on different TTYs (no ssh). I tried changing the code to

Code:

root soft maxlogins 1

with no luck AND

Code:

root hard maxlogins 1

still with no luck.

What is going on? Why am I still able to have simultanious root logins on my machine?

PS, No other additional configurations are in the file.
PPS, I decided to add a new line to prevent the only non-root user from multiple logins the same way and it works. It would appear this rule is not being applied to root for some reason. Please give me some insight.

Habitual · 04-29-2015, 09:27 AM

Code:

man limits.conf

says

Code:

maxlogins
               maximum number of logins for this user except for this with uid=0

MensaWater · 04-29-2015, 09:31 AM

uid=0 of course meaning the root user (or any bogus other users idiots create with the same uid 0 thinking it somehow protects them from just giving out the root password).

jakep219 · 04-29-2015, 09:44 AM

Thanks for the responses. Is there a way to effectively enforce this limit on the root user?

MensaWater · 04-29-2015, 09:51 AM

You might want to investigate use of /etc/securetty (man securetty to see details) as a more reasonable way of controlling root access by device rather than by number of logins.

If you restrict root login to the console and setup sudo to allow only certain admins to do "sudo su -" to become root you might more effectively both control who becomes root and log who does.