Enforce User and Group Resource Limits
Make sure resource-hungry users don’t bring down your entire system.
Whether it’s
through malicious intent or an
unintentional slip, having a user bring your system down to a slow
crawl by using too much memory or CPU time is no fun at all. One
popular way of limiting resource usage is to use the
ulimit
command. This method relies on a shell
to limit its child processes, and it is difficult to use when you
want to give different levels of usage to different users and groups.
Another, more flexible way of limiting resource usage is with the
PAM module
pam_limits.
pam_limits is preconfigured on most systems that
have PAM installed. All you should need to do is
edit
/etc/security/limits.conf to configure specific
limits for users and groups.
The limits.conf configuration file consists of
single-line entries describing a single type of limit for a user or
group of users. The general format for an entry is:
domain type resource valueThe domain portion specifies to whom the
limit applies. Single users may be specified here by name, and groups
can be specified by prefixing the group name with an
@. In addition, the wildcard character
* may be used to apply the limit globally to all
users except for root. The type portion of
the entry specifies whether the limit is a soft or
hard resource limit. Soft limits may be increased by the user, whereas hard limits can be changed only by root. There are many types of resources that can be specified for the ...