I have a setup that restricts the number of logins of a certain user to 1. I had it working fine with 3.6.1p2, but once 3.7.1p2 was installed no luck :-( Note I have set "UsePAM yes" explicitly like is needed in the new version. Also the previous version needed "UsePriviledgeSeperation no" for the number of logins to work correctly. Any input appreciated, thanks.
Which PAM modules do you have in your sshd PAM stack?
I just have a /etc/pam.d/other file: auth required pam_unix.so shadow nullok audit account required pam_unix.so shadow nullok audit account required pam_access.so password required pam_unix.so shadow nullok audit session required pam_limits.so session required pam_unix.so shadow nullok audit This is ages ago, but I vaguely remember openssh 3.7.1p2 explicitly ignoring the UsePriviledgeSeperation? which caused it to break
I had a quick peek at the source of pam_limits and the "logins" limit is implemented by counting utmp entries. Are the logins recorded correctly by the system (ie do the logins show up in "who" and/or "last")? BTW, the setting of UsePrivilegeSeparation should not be ignored at any time.
Please try a snapshot: this appears to be fixed in -current: I just tried it on my RH9 system. This is what I get on the server side: debug2: User child is on pid 24111 debug3: mm_request_receive entering Too many logins for 'dtucker'. Too many logins for 'dtucker'. PAM: pam_open_session(): Permission denied debug1: do_cleanup debug1: PAM: cleanup The client side gets: $ ssh -p 2022 localhost Read from remote host localhost: Connection reset by peer Connection to localhost closed. The limit appears to be enforced OK (as a side note: it should probably only output one session error and shut the connection down cleanly though).
The double-error was a misconfiguration on my end: I had pam_limits listed in /etc/pam.d/sshd and also in system-auth (which is loaded with pam_stack)
Thanks for the info I just have the default #PasswordAuthentication yes Note the problem I was having was if I set the login limit to X, only X-1 people could log in. I haven't tried the latest version yet.
Are you actually using PAM challenge-response for authentication? You should have "PasswordAuthentication no" in your sshd_config.
This looks like password auth vs PAM auth. Please reopen the bug if this anaysis is incorrect.
Mass change of RESOLVED bugs to CLOSED