Configuring pam_limits for Process Resource Constraints
In this lesson, you will learn how to leverage the pam_limits module to enforce strict memory and process count constraints for specific user groups during the authentication phase.
While you are already familiar with the general /etc/security/limits.conf file, integrating it directly into the PAM stack allows you to dynamically apply resource boundaries the moment a user initiates a session. This is critical for preventing "fork bombs" or memory-heavy runaway processes from destabilizing your shared systems.
Applying Constraints via PAM
To enforce these limits, you must ensure that pam_limits.so is included in the session section of your PAM configuration (typically found in /etc/pam.d/common-session or /etc/pam.d/login). The line looks like this:
session required pam_limits.so
Once this module is active in the stack, the system reads /etc/security/limits.conf whenever a session is opened. You can then define specific constraints for a group (prefixed by @) to ensure they don't exceed allocated resources:
# Format: <domain> <type> <item> <value>
@developers hard nproc 50
@developers soft memlock 1024
In this example, the developers group is restricted to a maximum of 50 concurrent processes (nproc). The hard limit acts as a ceiling that the user cannot exceed, while the soft limit represents the default threshold that the user can temporarily increase if permitted by system policy.
Why Use the PAM Stack?
By invoking this through the PAM stack rather than relying solely on global defaults, you guarantee that resource constraints are applied consistently across all login methods—whether the user accesses the system via SSH, a physical console, or a GUI session. If pam_limits.so is absent from the session stack, any settings defined in limits.conf will be ignored, leaving your system vulnerable to rogue processes consuming all available RAM or process slots.
Key Takeaway: By including pam_limits.so in your session PAM stack, you transform resource management from a static file configuration into a mandatory authentication enforcement mechanism.