Amit Shiknis

 Profile 

• Dec 10th, 2007

 

The Linux PAM (Pluggable Authentication Modules) where we can set useful limits for users or login, which can be configured in the /etc/security/limits.conf file.You can control the total limitation with the maxlogins option. Entries within limits.conf have the following structure: username|@groupname type resource limit.

Groupnames must be preceded by the @ to distinguish them from usernames. The type must be either soft or hard. Soft-limits can be exceeded and are usually warning marks, whereas hard-limits cannot be exceeded. A resource can be one of these keywords:

core - Limits the size of a core file (KB).
data - Maximum data size (KB).
fsize - Maximum file size (KB).
memlock - Maximum locked-in memory address space (KB).
nofile - Maximum number of open files.
rss - Maximum resident set size (KB).
stack - Maximum stack size (KB).
cpu - Maximum CPU time in minutes.
nproc - Maximum number of processes.
as - Address space limit.
maxlogins - Maximum number of logins allowed for this user.

In the following code example, all users are limited to 10 MB per session and are allowed a total of four simultaneous logins. The third line disables core dumps for everybody. The fourth line removes all limits for user bin. ftp is allowed to have 10 simultaneous sessions (which is especially useful for anonymous ftp accounts); members of the group managers are limited to 40 processes. developers have a memlock limit of 64 MB and all members of wwwusers cannot create files that are larger than 50 MB.

Listing 3. Setting quotas and limits

*           hard  rss        10000
*           hard  maxlogins      4
*           hard  core           0
bin         -
ftp         hard  maxlogins     10
@managers   hard  nproc         40
@developers hard  memlock    64000
@wwwusers   hard  fsize      50000

To activate these limits, you need to add the following line to the bottom of /etc/pam.d/login: session required /lib/security/pam_limits.so.

Please let me know if you have any questions.

Thanks,
Amit Shiknis