Messages in this thread | | | Date | Tue, 26 Oct 1999 17:01:10 +0300 | From | Matti Aarnio <> | Subject | Re: Sys Admin question |
| |
On Tue, Oct 26, 1999 at 09:37:00AM -0400, Michael Bacarella wrote: > This probably isn't the best place to ask, but it's Linux, and I trust the > natural order of internet flamethrowing to cordially correct me. > > I have a Linux server with evil users looking to destroy it (ISP). > Even effortlessly, I find that I can consume all of the VM on the system. > > The limits are set to something rather reasonable (10M of addressable > memory per process, 12 processes max per user). Stricter restrictions > make trivial tasks impossible (man, for one). Under this scheme, a single > user can still consume 120 megs of virtual memory.
Yes, memory accounting is per process. We don't have (nor BSD has) a per *user* memory limit, although such might be of what people like you would love to see.
> Perusing the kernel source shows that such a framework is in place, but no > real meat is attached to it, so it rules that option out (unless I'm > misreading). > > What can I do in the meantime? There's only so much swap space that I can > add, and I'm still vulnerable if enough users decide that they want to run > resource intensive tasks.
With 2.2 kernels (and fresh utilities) you can create 2 GB swap partitions, and (if I read mm/swapfile.c correctly), there is no upper hard limit on number of swap files/partitions allowed in the system. ( That is, after some fast swap, do throw in a 20 GB IDE disk sliced to 10 partitions, 2GB each.. I have heard that such monsters are around USD 400 apiece.. )
> It seems like the system can't say that enough is enough for a greedy user > and start making mmap() fail for them, choosing to instead axe some > processes (such as init(!)) to satisfy memory demand. > > Am I missing something bluntly obvious?
No. (Aside of not mentioning what kernel you are now running.)
> Thanks > -Michael Bacarella
/Matti Aarnio <matti.aarnio@sonera.fi>
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |