10

I am currently struggling with limiting number of processes for user which I called sandbox.

I configured processes limit inside /etc/security/limits.conf like this:

sandbox            hard    nproc            100

But if I want to connect to container as sandbox user, ssh returns:

shell request failed on channel 0

So I logged in as root and checked how many processes are running by sandbox user, but it's less than 5.

So what could be preventing me to login through ssh?
Without setting limits ssh login for sandbox user works ok.

Or is there any other way to prevent fork bomb attack?

dawud
  • 15,096
  • 3
  • 42
  • 61
eXPi
  • 101
  • 1
  • 3

1 Answers1

2

any error when connecting to an sshd is logged into /var/log/auth.log (in debian-based OS, or security in redhat-based systems)

If it's not, set LogLevel VERBOSE in /etc/ssh/sshd_config and reload sshd. This will show you why sshd is refusing your connection next.

That said, back to your fork-bomb limiter: docker machines are based on LXC, a container system for Linux. LXC are using CGROUPS to manage resource limits for each container.

in /sys/fs/cgroups, you can setup any limit for a running LXC, and in /Var/lib/lxc/vmname/config, you can setup the limits that will be enforced at boottime.

Limiting the number of processes in a cgroup is done by the task counter subsystem (added in the Linux kernel in 2011 http://lkml.iu.edu//hypermail/linux/kernel/1109.0/01455.html )

With a recent enough linux kernel, limiting the number of allowed processes for a cgroup is therefore done by adding this kind of line into your lxc's config file : 

lxc.cgroup.tasks.limit = 1024

for a maximum of 1024 processes

(disclaimer: information not checked on a real machine though, to be confirmed)

Benjamin Sonntag
  • 204
  • 1
  • 3
  • 1
    Thanks. For correction latest Docker containers are not based on LXC, LXC is available as driver. Docker containers native driver is based directly on kernel namespaces. But I really like idea with cgroups I did not know that it is possible limit process count. I am definitely going to try it. – eXPi Jun 28 '14 at 17:17
  • 2
    As of today the task counter sub system has still not landed in the official kernel. – Fabian Jakobs Aug 16 '14 at 12:56