Configure Linux user session limits with systemd and pam_limits for resource management

#!/usr/bin/env bash

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

# Default values
DEFAULT_MEMORY_LIMIT="2G"
DEFAULT_CPU_QUOTA="50%"
DEFAULT_MAX_PROCESSES="1024"

# Parse arguments
MEMORY_LIMIT="${1:-$DEFAULT_MEMORY_LIMIT}"
CPU_QUOTA="${2:-$DEFAULT_CPU_QUOTA}"
MAX_PROCESSES="${3:-$DEFAULT_MAX_PROCESSES}"

usage() {
    echo "Usage: $0 [memory_limit] [cpu_quota] [max_processes]"
    echo "  memory_limit: User memory limit (default: 2G)"
    echo "  cpu_quota: CPU quota per user (default: 50%)"
    echo "  max_processes: Maximum processes per user (default: 1024)"
    echo "Example: $0 4G 75% 2048"
    exit 1
}

if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
    usage
fi

# Cleanup function
cleanup() {
    echo -e "${RED}[ERROR] Installation failed. Cleaning up...${NC}"
    # Remove any created files on failure
    rm -f /etc/security/limits.d/99-user-limits.conf.tmp
    rm -rf /etc/systemd/system/user-.slice.d.tmp
    exit 1
}

trap cleanup ERR

# Check if running as root
if [[ $EUID -ne 0 ]]; then
    echo -e "${RED}This script must be run as root${NC}"
    exit 1
fi

echo -e "${GREEN}Configuring Linux user session limits with systemd and PAM${NC}"

# Auto-detect distribution
echo -e "${YELLOW}[1/7] Detecting system distribution...${NC}"
if [ -f /etc/os-release ]; then
    . /etc/os-release
    case "$ID" in
        ubuntu|debian)
            PKG_MGR="apt"
            PKG_INSTALL="apt install -y"
            PAM_PACKAGES="libpam-modules systemd"
            CGROUP_TOOLS="cgroup-tools"
            ;;
        almalinux|rocky|centos|rhel|ol|fedora)
            PKG_MGR="dnf"
            PKG_INSTALL="dnf install -y"
            PAM_PACKAGES="pam systemd"
            CGROUP_TOOLS="libcgroup-tools"
            ;;
        amzn)
            PKG_MGR="yum"
            PKG_INSTALL="yum install -y"
            PAM_PACKAGES="pam systemd"
            CGROUP_TOOLS="libcgroup-tools"
            ;;
        *)
            echo -e "${RED}Unsupported distribution: $ID${NC}"
            exit 1
            ;;
    esac
    echo -e "${GREEN}Detected: $PRETTY_NAME${NC}"
else
    echo -e "${RED}Cannot detect distribution${NC}"
    exit 1
fi

# Update package repository
echo -e "${YELLOW}[2/7] Updating package repository...${NC}"
if [[ "$PKG_MGR" == "apt" ]]; then
    apt update
fi

# Install required packages
echo -e "${YELLOW}[3/7] Installing required packages...${NC}"
$PKG_INSTALL $PAM_PACKAGES
# Install cgroup tools if available (may not exist on all systems)
$PKG_INSTALL $CGROUP_TOOLS || echo -e "${YELLOW}Warning: cgroup tools not available${NC}"

# Configure PAM limits
echo -e "${YELLOW}[4/7] Configuring PAM limits...${NC}"
cat > /etc/security/limits.d/99-user-limits.conf.tmp << 'EOF'
# User session limits configuration
# Format: <domain> <type> <item> <value>

# Default limits for all users
# Memory limits (in KB) - 2GB soft, 4GB hard
* soft as 2097152
* hard as 4194304

# Maximum number of processes
* soft nproc 1024
* hard nproc 2048

# Maximum number of open files
* soft nofile 4096
* hard nofile 8192

# CPU time limits (in seconds) - 1 hour soft, 2 hours hard
* soft cpu 3600
* hard cpu 7200

# Core dump size (disabled by default)
* soft core 0
* hard core 102400

# Maximum file size (in KB) - 1GB soft, 2GB hard
* soft fsize 1048576
* hard fsize 2097152

# Special service accounts
# Web server limits
www-data soft as 4194304
www-data hard as 8388608
www-data soft nproc 512
www-data hard nproc 1024
www-data soft nofile 8192
www-data hard nofile 16384

# Apache user (RHEL-based systems)
apache soft as 4194304
apache hard as 8388608
apache soft nproc 512
apache hard nproc 1024
apache soft nofile 8192
apache hard nofile 16384

# Nginx user
nginx soft as 4194304
nginx hard as 8388608
nginx soft nproc 512
nginx hard nproc 1024
nginx soft nofile 8192
nginx hard nofile 16384
EOF

# Move config file to final location
mv /etc/security/limits.d/99-user-limits.conf.tmp /etc/security/limits.d/99-user-limits.conf
chmod 644 /etc/security/limits.d/99-user-limits.conf
chown root:root /etc/security/limits.d/99-user-limits.conf

# Create systemd user slice configuration
echo -e "${YELLOW}[5/7] Configuring systemd user slice limits...${NC}"
mkdir -p /etc/systemd/system/user-.slice.d.tmp
cat > /etc/systemd/system/user-.slice.d.tmp/resource-limits.conf << EOF
[Unit]
Description=User Slice Resource Limits

[Slice]
# Memory limit per user
MemoryAccounting=yes
MemoryLimit=${MEMORY_LIMIT}

# CPU quota per user
CPUAccounting=yes
CPUQuota=${CPU_QUOTA}

# I/O limits
IOAccounting=yes
IOReadBandwidthMax=/ 50M
IOWriteBandwidthMax=/ 25M

# Task limit (maximum processes/threads)
TasksAccounting=yes
TasksMax=${MAX_PROCESSES}
EOF

# Move systemd config to final location
mv /etc/systemd/system/user-.slice.d.tmp /etc/systemd/system/user-.slice.d
chmod 755 /etc/systemd/system/user-.slice.d
chmod 644 /etc/systemd/system/user-.slice.d/resource-limits.conf
chown -R root:root /etc/systemd/system/user-.slice.d

# Reload systemd configuration
echo -e "${YELLOW}[6/7] Reloading systemd configuration...${NC}"
systemctl daemon-reload

# Verify configuration
echo -e "${YELLOW}[7/7] Verifying configuration...${NC}"

# Check PAM limits file
if [[ -f /etc/security/limits.d/99-user-limits.conf ]]; then
    echo -e "${GREEN}✓ PAM limits configuration created successfully${NC}"
else
    echo -e "${RED}✗ PAM limits configuration failed${NC}"
    exit 1
fi

# Check systemd user slice configuration
if [[ -f /etc/systemd/system/user-.slice.d/resource-limits.conf ]]; then
    echo -e "${GREEN}✓ Systemd user slice configuration created successfully${NC}"
else
    echo -e "${RED}✗ Systemd user slice configuration failed${NC}"
    exit 1
fi

# Verify systemd can load the configuration
if systemctl cat user-.slice >/dev/null 2>&1; then
    echo -e "${GREEN}✓ Systemd configuration is valid${NC}"
else
    echo -e "${RED}✗ Systemd configuration validation failed${NC}"
    exit 1
fi

echo -e "${GREEN}Installation completed successfully!${NC}"
echo
echo -e "${YELLOW}Configuration Summary:${NC}"
echo "- Memory limit per user: ${MEMORY_LIMIT}"
echo "- CPU quota per user: ${CPU_QUOTA}"
echo "- Maximum processes per user: ${MAX_PROCESSES}"
echo "- PAM limits configured in: /etc/security/limits.d/99-user-limits.conf"
echo "- Systemd limits configured in: /etc/systemd/system/user-.slice.d/resource-limits.conf"
echo
echo -e "${YELLOW}Next steps:${NC}"
echo "1. User limits will apply to new login sessions"
echo "2. Existing users may need to log out and back in"
echo "3. Test with: ulimit -a (for PAM limits)"
echo "4. Monitor with: systemctl status user-\$UID.slice (for systemd limits)"
echo "5. View current limits: cat /proc/\$PID/limits"