diff --git a/weed/server/master_grpc_server.go b/weed/server/master_grpc_server.go
index e5fcacc0e..1785a8ccb 100644
--- a/weed/server/master_grpc_server.go
+++ b/weed/server/master_grpc_server.go
@@ -190,6 +190,19 @@ func (ms *MasterServer) KeepConnected(stream master_pb.Seaweed_KeepConnectedServ
 
 	peerAddress := findClientAddress(stream.Context(), req.GrpcPort)
 
+	// only one shell can be connected at any time
+	if req.Name == "shell" {
+		if ms.currentAdminShellClient == ""{
+			ms.currentAdminShellClient = peerAddress
+			defer func() {
+				ms.currentAdminShellClient = ""
+			}()
+		} else {
+			return fmt.Errorf("only one concurrent shell allowed, but another shell is already connected from %s", peerAddress)
+		}
+	}
+
+
 	stopChan := make(chan bool)
 
 	clientName, messageChan := ms.addClient(req.Name, peerAddress)
diff --git a/weed/server/master_server.go b/weed/server/master_server.go
index 4a264d432..d089370db 100644
--- a/weed/server/master_server.go
+++ b/weed/server/master_server.go
@@ -64,6 +64,8 @@ type MasterServer struct {
 	grpcDialOption grpc.DialOption
 
 	MasterClient *wdclient.MasterClient
+
+	currentAdminShellClient string
 }
 
 func NewMasterServer(r *mux.Router, option *MasterOption, peers []string) *MasterServer {