MAX_LOGIN_SESSIONS

[Rick Garland]

Here is another one. What do you folks typically use for the MAX_LOGIN_SESSIONS?

[Florian Heigl (new acc)]

Hi,

/etc/default/security is 'default' as in 'not there', so I think that kernel parameter should apply...
11.11:
Parameter Current Dyn Planned Module Version
===============================================================================
maxusers 512 - 512
11.00:
Parameter Value
===============================================================================
maxusers 512

(after *bad* experiences ;)

I hope this is what You wanted to know :)

[Rick Garland]

I looking for consensus. What are most of the SYS ADMINS setting this parameter to?

[Fred Ruffet]

Where do you set this ?

Fred

[Rick Garland]

I am on HPUX 11.11.

In the /etc/default/security file.

I believe this is in 11.00 as well.

[Fred Ruffet]

I don't have /etc/default/security...

maxusers is set to 512 on most systems, but one has 32, the other 2000... I can't give a universal rule.
Note that maxusers is only used in calculation rules for other parameters, it won't stop connections. If you change formulas, it won't be usefull at all.

Regards,

Fred

[Sanjay_6]

Hi Rick,

Are you talking about the "NUMBER_OF_LOGINS_ALLOWED" parameter in the /etc/default/security file.

I think "2" should be a good number unless the account is shared between multiple users. Do remeber that this restriction does not apply to root (i think).

Hope this helps.

Regds

[Rick Garland]

Yes, I am referring to the maximum number of login sessions a user can open.

Right now the /etc/default/security file does not have this parameter set. I would like to setit.

I do have the SU_ROOT_GROUP in the security file.

[Sanjay_6]

Hi Rick,

do remeber that ftp does not look at /etc/default/security file and hence this option would be ignored for users doing ftp to this system. Also i think there are enhancement requests out there for ssh/rexecd to use this paramerer unless they have been resolved already.

What i meant by saying that the parameter is not applicable to root is that, say this parameter is set to "2", root can have more than 2 login sessions. The parameter is only applicable to normal users.

Hope this helps.

Regds

[Rick Garland]

Correct - ftp does not look at this parameter.
You would limit ftp logins through the ftp access files (I believe that is correct).

With the root user I am not too worried about.

I am not completely sure but there is a configuration in the sshd_configuration file that has a value for MaxStartups. I wounder if this value was manipulated you could limit the number of ssh logins?

[Sanjay_6]

Hi Rick,

I was checking on "Maxstartups" and i found that

/Quote/

MaxStartups does not mean the total number of connections, only the total number of unauthorizated ones.

/EndQuote/

that means the system will have that many numbers of open connections that have not been validated yet. That many number of people trying to login who haven't been authenticated yet.

Hope this helps.

regds

[Rick Garland]

Many thanks - this post is confusing and it is my fault.

Thanks again