usnistgov/macos_security
1
0
Fork 0
mirror of https://github.com/usnistgov/macos_security.git synced 2026-02-03 05:53:24 +00:00
Code Issues 21 Actions Packages Projects Releases Wiki Activity

Concurrent session limit for SSH is not working #314

New Issue
Closed
opened 2026-01-19 18:30:02 +00:00 by michael · 1 comment
michael commented 2026-01-19 18:30:02 +00:00
Owner
Copy Link

Originally created by @cistone on GitHub.

Summary

Setting "os_ssh_max_sessions_configure" does not limit connections on my machine.

Steps to reproduce

Set "MaxSessions 10" in sshd.conf
from another machine, open multiple ssh connections to the ssh server.

Operating System version

20A5343i

What is the current bug behavior?

The number of sessions is not capped at 10.

What is the expected correct behavior?

After 10 connections, further connection attempts should fail.

Originally created by @cistone on GitHub. ### Summary Setting "os_ssh_max_sessions_configure" does not limit connections on my machine. ### Steps to reproduce Set "MaxSessions 10" in sshd.conf from another machine, open multiple ssh connections to the ssh server. ### Operating System version 20A5343i ### What is the current *bug* behavior? The number of sessions is not capped at 10. ### What is the expected *correct* behavior? After 10 connections, further connection attempts should fail.
michael commented 2026-01-19 18:30:02 +00:00
Author
Owner
Copy Link

@robertgendler commented on GitHub:

The MaxSessions setting within sshd.conf does not do what people think it does exactly.

This turns out the only way to limit it is by editing the kernel variables which is not advised.
sudo sysctl -w kern.tty.ptmx_max=

The AC-10 requirement in the NIST 800-53 is met inherently with os_limit_gui_sessions.

@robertgendler commented on GitHub: The MaxSessions setting within sshd.conf does not do what people think it does exactly. This turns out the only way to limit it is by editing the kernel variables which is not advised. sudo sysctl -w kern.tty.ptmx_max=<number> The AC-10 requirement in the NIST 800-53 is met inherently with os_limit_gui_sessions.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
michael
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: usnistgov/macos_security#314
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?