Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add j2 template for enable pam_limit and limit SSH session #10177

Merged
merged 13 commits into from
Mar 31, 2022
62 changes: 62 additions & 0 deletions files/build_templates/limits.conf.j2
Original file line number Diff line number Diff line change
@@ -0,0 +1,62 @@
# /etc/security/limits.conf
liuh-80 marked this conversation as resolved.
Show resolved Hide resolved
#
# This file generate by j2 template file: files\build_templates\limits.conf.j2
liuh-80 marked this conversation as resolved.
Show resolved Hide resolved
#
#Each line describes a limit for a user in the form:
liuh-80 marked this conversation as resolved.
Show resolved Hide resolved
#
#<domain> <type> <item> <value>
liuh-80 marked this conversation as resolved.
Show resolved Hide resolved
#
#Where:
#<domain> can be:
# - a user name
# - a group name, with @group syntax
# - the wildcard *, for default entry
# - the wildcard %, can be also used with %group syntax,
# for maxlogin limit
# - NOTE: group and wildcard limits are not applied to root.
# To apply a limit to the root user, <domain> must be
# the literal username root.
#
#<type> can have the two values:
# - "soft" for enforcing the soft limits
# - "hard" for enforcing hard limits
#
#<item> can be one of the following:
# - core - limits the core file size (KB)
# - data - max data size (KB)
# - fsize - maximum filesize (KB)
# - memlock - max locked-in-memory address space (KB)
# - nofile - max number of open file descriptors
# - rss - max resident set size (KB)
# - stack - max stack size (KB)
# - cpu - max CPU time (MIN)
# - nproc - max number of processes
# - as - address space limit (KB)
# - maxlogins - max number of logins for this user
# - maxsyslogins - max number of logins on the system
# - priority - the priority to run user process with
# - locks - max number of file locks the user can hold
# - sigpending - max number of pending signals
# - msgqueue - max memory used by POSIX message queues (bytes)
# - nice - max nice priority allowed to raise to values: [-20, 19]
# - rtprio - max realtime priority
# - chroot - change root to directory (Debian-specific)
#
#<domain> <type> <item> <value>
#

#* soft core 0
#root hard core 100000
#* hard rss 10000
#@student hard nproc 20
#@faculty soft nproc 20
#@faculty hard nproc 50
#ftp hard nproc 0
#ftp - chroot /ftp
#@student - maxlogins 4

{% for user in limitusers %}
{{ user.username }} hard maxlogins {{ user.maxlogin }}
{% endfor %}

# End of file
16 changes: 16 additions & 0 deletions files/build_templates/pam_limits.j2
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
#THIS IS AN AUTO-GENERATED FILE
#
# This file generate by j2 template file: files\build_templates\pam_limits.j2
liuh-80 marked this conversation as resolved.
Show resolved Hide resolved
#
# /etc/pam.d/pam-limits settings common to all services
# This file is included from other service-specific PAM config files,
# and should contain a list of the authentication modules that define
# the central authentication scheme for use on the system
# (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default is to use the
# traditional Unix authentication mechanisms.
#
# here are the per-package modules (the "Primary" block)

{% if sonic_enable_pam_limit == 'true' %}
liuh-80 marked this conversation as resolved.
Show resolved Hide resolved
session required pam_limits.so
{% endif %}