Splunk Search

Splunk Enterprise maximum local users?

season88481
Contributor

Hi

Could not find a setting in limits.conf OR authentication.conf. But is there a maximum number of local users we can create in a Splunk Enterprise instance?

Thanks.

0 Karma
1 Solution

inventsekar
Super Champion

i dont think there is a limit for maximum number of local users, (probably the Operating systems limit will apply i think)

in any case, we might never need to reach the maximum number of users.

from googled -

Limit for creating users:

Theoretically you can have as many users as the user ID space supports. To determine this on a particular system check out the definition of the uid_t type. It is usually defined as unsigned_int or int. On intel architectures, sizes are defined in /usr/include/bits/typsizes.h. You can check value of this variable in your system by typing following command on terminal

cat /usr/include/bits/typesizes.h | grep UID_T

In my system, output of this command shows:

#define __UID_T_TYPE   __U32_TYPE

This means system can host 4294967296 (2^32) different users. However, other resources may become exhausted before you reach this limit, e.g. disk space. If you create a home directory for each user then even with just 1MB of space for each user you need over 4PBs of storage. Also, large number of users leaving processes running in the background, scheduling cron jobs, opening ftp and/or ssh sessions can create a severe burden on the system.

Limit for simultaneous logins:

When logging in using SSH, you use a pseudo-terminal (a pty) allocated to the SSH daemon, not a real one (a tty). Pseudo-terminals are created and destroyed as needed. You can find the number of ptys allowed to be allocated at one time by

cat /proc/sys/kernel/pty/max

In my system, output of this command shows:

4096

This means 4096 users can simultaneously login on this machine (remote login).

PS: My Linux distribution is 64-bit Fedora 23

>>> Happy Splunking !

View solution in original post

inventsekar
Super Champion

i dont think there is a limit for maximum number of local users, (probably the Operating systems limit will apply i think)

in any case, we might never need to reach the maximum number of users.

from googled -

Limit for creating users:

Theoretically you can have as many users as the user ID space supports. To determine this on a particular system check out the definition of the uid_t type. It is usually defined as unsigned_int or int. On intel architectures, sizes are defined in /usr/include/bits/typsizes.h. You can check value of this variable in your system by typing following command on terminal

cat /usr/include/bits/typesizes.h | grep UID_T

In my system, output of this command shows:

#define __UID_T_TYPE   __U32_TYPE

This means system can host 4294967296 (2^32) different users. However, other resources may become exhausted before you reach this limit, e.g. disk space. If you create a home directory for each user then even with just 1MB of space for each user you need over 4PBs of storage. Also, large number of users leaving processes running in the background, scheduling cron jobs, opening ftp and/or ssh sessions can create a severe burden on the system.

Limit for simultaneous logins:

When logging in using SSH, you use a pseudo-terminal (a pty) allocated to the SSH daemon, not a real one (a tty). Pseudo-terminals are created and destroyed as needed. You can find the number of ptys allowed to be allocated at one time by

cat /proc/sys/kernel/pty/max

In my system, output of this command shows:

4096

This means 4096 users can simultaneously login on this machine (remote login).

PS: My Linux distribution is 64-bit Fedora 23

>>> Happy Splunking !

season88481
Contributor

very good answer. Thanks.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...