Sshd_config MaxSessions parameter

ssh-tunnelingsshd

I have problem with "MaxSessions" parameter in sshd.

I would like to restrict number of sessions via one ssh connection. For example for tcp forwarding.
When I set MaxSessions to 0, logons are not working (thats fine, thats how it should work) but when I set to 1 I can have multiple sessions (even 1 disables multiplexing) via one ssh connection and set it to 2 or more has no effect as well then.
Maybe you can direct me to right solution.

I test it like this: Open ssh connection from putty (win) to server(BSD). Port forwarding is in use (for http). So I use SOCKS in browser.
I download two files simultaneously from two different websites and it works for both through this tunnel but it should not (MaxSessions is set to 1).

  • sshd – OpenSSH 5.2 portable for FreeBSD
  • OS – FBSD 6.2

Thank you for any help.

Best Answer

From sshd_config(5)

MaxSessions Specifies the maximum number of open sessions permitted per network connection. The default is 10.

This man entry for this particular limit is somewhat vague. The change log message adding this feature is a bit more helpful:

Added a MaxSessions option to sshd_config(5) to allow control of the number of multiplexed sessions supported over a single TCP connection. This allows increasing the number of allowed sessions above the previous default of 10, disabling connection multiplexing (MaxSessions=1) or disallowing login/shell/subsystem sessions entirely (MaxSessions=0).

Effectively, the MaxSessions parameter is meant to limit the number of multiplexed ssh sessions you can have over a single ssh session. See the ControlMaster section of ssh_config(5).

Session multiplexing allows you to setup a single Master connection which all other connections to the same host can then reuse (but they don't have to). This has no effect on port forwarding, or SOCKS proxying. It also has no effect on my ability to connect again to the same host via a new network connection. It is really specific to connection multiplexing, and nothing more.

Related Question