Implementing User-Based Resource Quotas

You will prevent disk exhaustion by applying filesystem quotas to specific user home directories.

In this lesson, you will learn how to prevent a single user from consuming all available disk space by implementing filesystem-level quotas on their home directory.

Understanding Disk Quotas

Even with strict account lifecycle policies and restricted shells, a user could accidentally—or maliciously—fill up your entire disk partition by writing massive files. This can cause critical system services to fail because they lack the room to create temporary log or lock files. To prevent this, Linux allows you to impose a hard limit on the amount of disk space (blocks) and the number of files (inodes) a specific user can own.

Implementing Quotas

To apply these limits, your filesystem must be mounted with specific options. You typically enable this in your /etc/fstab file by adding usrquota to the mount options for the partition containing /home.

Once enabled, you use the quota management tools to set the threshold for a user. For example, to set a hard limit of 500 Megabytes for a user named jdoe, you would perform the following steps:

Enable the quota system on the filesystem.
Set the limits using the edquota command:
```
sudo edquota -u jdoe
```
This command opens a text editor where you can specify the "hard" limit (the absolute maximum) and the "soft" limit (a warning threshold).
Verify the status of the user's consumption:
```
sudo quota -vs jdoe
```

When the user attempts to save a file that pushes their total usage beyond the "hard" limit, the kernel will immediately deny the write operation, returning a "Disk quota exceeded" error. This ensures that even if a user’s process goes rogue, your system’s core stability remains protected. By applying these quotas, you move from simply managing user accounts to actively safeguarding the underlying infrastructure they interact with.

Key Takeaway: User-based resource quotas act as a safety net, enforcing strict disk usage boundaries that prevent individual users from destabilizing the entire system by exhausting storage capacity.