PAM_LIMITS(8)

💖 NAME 💖

pam_limits — bestie, it's the PAM module that puts a cap on your system resources 🔥

---

✨ SYNOPSIS ✨

pam_limits.so [conf=/path/to/limits.conf] [debug] [set_all] [utmp_early]
              [noaudit]

---

🦋 DESCRIPTION 🦋

okay so here's the tea: pam_limits is a PAM module that sets limits on the system resources you can grab in a user-session. and yes, even users with uid=0 are affected by these limits — no one is above the limit law, not even root 💅

by default, limits get pulled from the /etc/security/limits.conf config file. then the individual *.conf files in the /etc/security/limits.d/ directory get read too. these files are parsed one after another in the order of the "C" locale. and the effect of all the individual files is the same as if you'd concatenated them all together in parsing order. BUT — if you explicitly specify a config file with a module option, then the files in that directory are not parsed. periodt.

⚠️ important: this module must not be called by a multithreaded application. like, don't. that's the rule.

and if Linux PAM is compiled with audit support, the module will report when it denies access based on the limit of maximum number of concurrent login sessions 👀

---

🎀 OPTIONS 🎀

• conf=/path/to/limits.conf — point at an alternative limits.conf-style config file to override the default one 🗂️
• debug — print debug info. classic. 🔍
• set_all — sets the limits for which no value is specified in the config file to the one from the process with the PID 1. but heads up bestie: if the init process is systemd, these limits will not be the kernel default limits, and you should not use this option 🙈
• utmp_early — some broken applications actually allocate a utmp entry for the user before the user is admitted to the system. if some of the services you're configuring PAM for do this, you can selectively use this module argument to compensate for that behavior, and at the same time keep system-wide consistency with a single limits.conf file 🧚
• noaudit — don't report exceeded maximum logins count to the audit subsystem 🤫

---

👑 MODULE TYPES PROVIDED 👑

only the session module type is provided. that's it. that's the whole list. 💀

---

🌈 RETURN VALUES 🌈

• PAM_ABORT — cannot get current limits 😭
• PAM_IGNORE — no limits found for this user 🤷
• PAM_PERM_DENIED — new limits could not be set 🚫
• PAM_SERVICE_ERR — cannot read config file 📄
• PAM_SESSION_ERR — error recovering account name 😵
• PAM_SUCCESS — limits were changed, slay ✨
• PAM_USER_UNKNOWN — the user is not known to the system 👻

---

🍓 FILES 🍓

• /etc/security/limits.conf — the default configuration file 💖

---

🌸 EXAMPLES 🌸

for the services where you need resource limits (login, for example), put the following line in /etc/pam.d/login as the last line for that service — usually after the pam_unix session line:

#%PAM-1.0
#
# Resource limits imposed on login sessions via pam_limits
#
session  required  pam_limits.so

and then just replace "login" for each service you're using this module with 🫶

---

⭐ SEE ALSO ⭐

limits.conf(5), pam.d(5), pam(8).

---

💜 AUTHORS 💜

pam_limits was initially written by Cristian Gafton <gafton@redhat.com> — iconic behavior, we love to see it 💅

---

and that's the whole vibe check bestie — this is from the Linux-PAM crew, dated 09/27/2026, and it's giving documentation excellence. mwah. 🎀✨