Oct 27th, 2009
Preventing Accidental Denial of Service
Preventing Accidental Denial of Service
Linux allows you to set limits on the amount of system resources that users and groups can use.
Restricting System Resources
The following example shows a practical use of setting or restricting system resources for an database user account. For a list of system resource settings, see /etc/security/limits.conf. It would be a good idea to review the default settings of system resource.
database hard nofile 63536
The “soft limit” in the first line defines the number of file handles or open files that the database user will have after login. If the database user gets error messages about running out of file handles, then the database user can increase the number of file handles like in this example up to 63536 (”hard limit”) by running the following command:
ulimit -n 63536
Most shells like Bash provide control over various resources like the maximum allowable number of open file descriptors or the maximum number of processes available to a user. To see all shell limits, run:
ulimit -a
core file size (blocks, -c) 0
data seg size (kbytes, -d) unlimited
scheduling priority (-e) 20
file size (blocks, -f) unlimited
pending signals (-i) 16382
max locked memory (kbytes, -l) 64
max memory size (kbytes, -m) unlimited
open files (-n) 1024
pipe size (512 bytes, -p) 8
POSIX message queues (bytes, -q) 819200
real-time priority (-r) 0
stack size (kbytes, -s) 8192
cpu time (seconds, -t) unlimited
max user processes (-u) unlimited
virtual memory (kbytes, -v) unlimited
file locks (-x) unlimited
Each line describes a limit for a user in the form:
#
#Where:
# can be:
# - an user name
# - a group name, with @group syntax
# - the wildcard *, for default entry
# - the wildcard %, can be also used with %group syntax,
# for maxlogin limit
# - NOTE: group and wildcard limits are not applied to root.
# To apply a limit to the root user, must be
# the literal username root.
#
# can have the two values:
# - “soft” for enforcing the soft limits
# - “hard” for enforcing hard limits
# - cpu - max CPU time (MIN)
# - nproc - max number of processes
# - core - limits the core file size (KB)
Example:
@faculty soft nproc 50
