When I set my /lib/security/limits.conf entries to set maxlogin to 1, Pam allows 2 logins for that user; if I set it to 0, Pam allows no logins at all.

Example:

user1 - maxlogins 1
user2 - maxlogins 3
user3 - maxlogins 1
user4 - maxlogins 1
user5 - maxlogins 1
user6 - maxlogins 1
user7 - maxlogins 0
# End of file

user2 can log on 4 times, the 5th bring up the following error:

Too many logins for user2
Too many logins for user2

which is also generated if user7 tries to log in at all or if all the others try to log in more than 2 times.

In summary, Pam allows 1 extra login than specified, unless it's 0, so how can I get it to allow only 1 login?

Add a patch? Dunno your PAM version, but this seems to be for pam-0.74, and it's old: http://bugzilla.redhat.com/bugzilla/...4&action=view, but the 0.75 I'm running still exhibits the same behaviour as you reported so I think it's either disfunct code or it wasn't added. Anyone?

My docs are for pam-0.74 and pam_krb5-1.31, but my /etc/pam.d config files all have #%Pam-1.0 as the first line.
So, I'm a little unsure what my pam version is.

So, I'm a little unsure what my pam version is.
Check with whatever your package manager has for commands.
From the docdir I'd say your version should be 0.74.