One of the methods I use to bypass internet filtering/censorship in my country is SSH tunneling. To do this, I create a user on an Ubuntu 18.04 server using the command adduser USERNAME --shell=/bin/false. However, there is a major flaw in this method, which is that multiple users with different IP addresses can simultaneously connect to my server using this username, causing the server's IP to be filtered by the government. How can I prevent two or more users with different IPs from connecting (SSH tunneling) to my server simultaneously using one username?

P.s. I am a beginner Linux and Ubuntu user, so please explain all the steps in a simple way.

  • Damn! Are you connecting from North Korea? 😳 If the actual usage is tunneling why don't use wireguard instead?
    – Igor Popov
    May 1 at 15:27
  • Couldn't you just do something like set up SSH keys and then, you know, not give the keys to anyone else?
    – KGIII
    May 2 at 21:16
  • @KGIII I am new to Linux servers. Could you please explain it as an answer in a simple way or at least provide a link for me to read about it myself? May 2 at 21:56
  • 1
    It's not really an answer to your question, it's something else entirely. Otherwise, I'd happily make it an answer. You can read [this link] to learn how to do this. I don't actually have an answer for your specific question. It's just another option.
    – KGIII
    May 2 at 21:59
  • 1
    @KGIII Thank you for your comment, but it seems like you forgot to include the link. May 2 at 22:08

2 Answers 2


A simple method to prevent simultaneous connections from multiple IPs would be to limit the number of active sessions a user can have open. This can be done by creating a single file and restarting the SSH daemon.

Here's how you can do it:

  1. Connect to your server (if not already connected)
  2. Create a file in /etc/security/limits.d to contain the connection limit rule:
    sudo {editor of choice} /etc/security/limits.d/10-ssh.conf 
    Note: Be sure to replace {editor of choice} with your preferred text editor.
  3. Paste or type the following into the new file:
    # Additional limits for users of SSH
    *    hard    maxlogins   1
  4. Save the file
  5. Restart the SSH daemon
    sudo service ssh restart

How the configuration works

Item Meaning
* Who the rule applies to
hard What level of enforcement should be used
maxlogins What is being enforced
1 The limit to enforce

If you would like only certain users to have limits, you can replace * with a specific user name. For example:

johnny   hard   maxlogins   3

This will limit just the johnny account to three simultaneous sessions.

If you would like certain user groups to have limits, you can replace * with a group name. For example:

@family   hard   maxlogins   1

This will limit accounts in the family group to one simultaneous connection.

If you would like multiple levels, you can add more lines to the file. For example:

# Additional limits for users of SSH
@family   hard   maxlogins   1
johnny    hard   maxlogins   2
*         hard   maxlogins   3

If you decide to remove the limits in the future, simply delete the file or rename it to something like 10-ssh.old and restart the SSH daemon.

  • Thank you for your answer, but it didn't work. I created two configurations with the same username and password on two mobile phones with two different IP addresses. Then I exactly followed the solution you suggested, but both phones were able to connect to my server simultaneously. Apr 25 at 19:27

On Ubuntu pam_limits can limit the number of sessions per user.

While you read the configuration files of Ubuntu from /etc/pam.d/login for example you can find a line something like session require pam_limits.so.

# Sets up user limits according to /etc/security/limits.conf
# (Replaces the use of /etc/limits in old login)
session require pam_limits.so

So, the path for configuration files for limits has been changed comparing to older versions of login.

Anyway it goes to /etc/security/ location same as in the previous answer by @matigo however I would edit limits.conf file instead of creating files in subfolders since it's only one user you need limit.

In order to limit the number of sessions per user, you can add entries to a file in /etc/security/limits.conf

Actually you see examples in the comments in this file

Add a line by the end of file:

#<domain>      <type>  <item>         <value>
johndoe         hard    maxlogins      1

Bear in mind to logout your user johndoe and restart sshd after your edits to apply.

pkill -9 -u johndoe # kill all running apps under johndoe user
service ssh restart

To kill exactly johndoe terminal sessions

# First run "w" command

[root@vps ~]# w
00:34:21 up 48 days, 23:38, 4 users, load average: 0.79, 0.58, 0.56
kate pts/0 19:47 4:45m 0.04s 0.00s mc
johndoe pts/1 20:35 3:54m 2:23 0.00s nano
max pts/2 00:27 5.00s 0.08s 0.04s top
root pts/4 00:34 1.00s 0.02s 0.01s w

# then use pkill
pkill -9 -t pts/1

# then restart SSH
service ssh restart

P.S. I didn't tested, but maybe you would need "-" instead of "hard" in a limit type column.

#<domain>      <type>  <item>         <value>
johndoe         -       maxlogins      1

That should be a solution in case you stick with a direct SSH connection... but if you use it for tunneling why just don't use something like wireguard?

EDIT 2023-05-02

While you use SSH tunneling I believe you need some workaround. Stream connections are not visible with w command, but you can reveal them with netstat.

So my guess is to use ~/.ssh/rc to see and count your running connections in case johndoe - maxlogins 1 in limits.conf not working.

First check PermitUserRC option in sshd_config. You need to enable it (by default it's enabled) and restart ssh service.

Then use a script to check amount of connections from current IP. Here is a draft script to use (add these lines into your ~/.ssh/rc under user johndoe):

myip=`awk -F" " '{split($0,a); print a[1]}' <<< $SSH_CLIENT`
conncount=`netstat -anpW | grep ':22 \+' | grep ESTABLISHED | grep $myip | wc -l`
if test $conncount -gt 1; then exit 429; fi;

Explanation: Line (1) Get your current IP, (2) Count amount of connections to :22 port from $myip and (3) if we have greater than 1 connection from this our IP terminate process and exit with error code 429

  • Thanks for your answer, but it doesn't work! I created two configurations with the same username and password on two mobile phones with two different IP addresses. Then I edited file /etc/security/limits.conf and added johndoe - maxlogins 1 (see this screenshot), but both phones were able to connect to my server simultaneously! I tried johndoe hard maxlogins 1, too. I want this for ssh tunneling. The WireGuard protocol does not work with many ISPs in Iran. May 1 at 19:49
  • 2
    @vahid johndoe - maxlogins 1 should work. Anyway you use SSH tunneling, so the connection won't show up in w output. It means this is a nologin system user so maxlogins in limits.conf is not useful and same as MaxSessions in sshd_config has no effect on port forwarding. You connect over SOCKS proxy, which is tied to a web browser, which usually opens multiple streams at once with nologin. You can listen 10022 in sshd_config and use this 10022 port in your SOCKS connection without limits if it works for you.. However I could not to find an option to limit nologin.
    – Igor Popov
    May 2 at 15:46
  • @VahidDamanafshan I guess you should dig to the PermitUserRC in sshd_config. You need to enable it (by default it's enabled). Then add some script wrapper into ~/.ssh/rc
    – Igor Popov
    May 2 at 16:04
  • @VahidDamanafshan how do you connect your phone(s)?
    – Igor Popov
    May 2 at 16:43
  • I connect the phones by apps like Matsuri and then in +icon->Manual Settings->SSH and then I write the server's Ip, port, username, and password (please see this screenshot). May 2 at 17:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .