>From 17387a543e980ef4fa56fe9ed045fe19974faabb Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Sun, 10 Nov 2013 00:40:28 -0500 Subject: [PATCH 03/11] OVAL + remediation for accounts_max_concurrent_login_sessions - Updated XCCDF/OVAL naming, used accounts_* scheme for consistency - Added remediation TESTING: [root@SSG-RHEL6 checks]# var_accounts_max_concurrent_login_sessions=10; export var_accounts_max_concurrent_login_sessions [root@SSG-RHEL6 checks]# ./testcheck.py accounts_max_concurrent_login_sessions.xml external_variable with id : var_accounts_max_concurrent_login_sessions Evaluating with OVAL tempfile : /tmp/accounts_max_concurrent_login_sessionsbaLfPY.xml Writing results to : /tmp/accounts_max_concurrent_login_sessionsbaLfPY.xml-results Definition oval:scap-security-guide.testing:def:267: false Evaluation done. [root@SSG-RHEL6 checks]# cd ../fixes/bash/ [root@SSG-RHEL6 bash]# bash accounts_max_concurrent_login_sessions.sh [root@SSG-RHEL6 bash]# cd - /var/www/html/scap-security-guide/RHEL6/input/checks [root@SSG-RHEL6 checks]# ./testcheck.py accounts_max_concurrent_login_sessions.xml external_variable with id : var_accounts_max_concurrent_login_sessions Evaluating with OVAL tempfile : /tmp/accounts_max_concurrent_login_sessionsPCTxZb.xml Writing results to : /tmp/accounts_max_concurrent_login_sessionsPCTxZb.xml-results Definition oval:scap-security-guide.testing:def:267: true Evaluation done. --- RHEL6/input/auxiliary/stig_overlay.xml | 2 +- .../accounts_max_concurrent_login_sessions.xml | 4 ++-- .../bash/accounts_max_concurrent_login_sessions.sh | 4 ++++ RHEL6/input/profiles/CS2.xml | 4 ++-- RHEL6/input/profiles/fisma-medium-rhel6-server.xml | 4 ++-- RHEL6/input/profiles/stig-rhel6-server.xml | 4 ++-- RHEL6/input/system/accounts/session.xml | 6 +++--- 7 files changed, 16 insertions(+), 12 deletions(-) create mode 100644 RHEL6/input/fixes/bash/accounts_max_concurrent_login_sessions.sh diff --git a/RHEL6/input/auxiliary/stig_overlay.xml b/RHEL6/input/auxiliary/stig_overlay.xml index d322169..e47d427 100644 --- a/RHEL6/input/auxiliary/stig_overlay.xml +++ b/RHEL6/input/auxiliary/stig_overlay.xml @@ -705,7 +705,7 @@ The system must have USB Mass Storage disabled unless needed. - + The system must limit users to 10 simultaneous system logins, or a site-defined number, in accordance with operational requirements. diff --git a/RHEL6/input/checks/accounts_max_concurrent_login_sessions.xml b/RHEL6/input/checks/accounts_max_concurrent_login_sessions.xml index a3658ff..062edb7 100644 --- a/RHEL6/input/checks/accounts_max_concurrent_login_sessions.xml +++ b/RHEL6/input/checks/accounts_max_concurrent_login_sessions.xml @@ -26,9 +26,9 @@ - + - + diff --git a/RHEL6/input/fixes/bash/accounts_max_concurrent_login_sessions.sh b/RHEL6/input/fixes/bash/accounts_max_concurrent_login_sessions.sh new file mode 100644 index 0000000..945dd0f --- /dev/null +++ b/RHEL6/input/fixes/bash/accounts_max_concurrent_login_sessions.sh @@ -0,0 +1,4 @@ +source ./templates/support.sh +populate var_accounts_max_concurrent_login_sessions + +echo "* hard maxlogins $var_accounts_max_concurrent_login_sessions" >> /etc/security/limits.conf diff --git a/RHEL6/input/profiles/CS2.xml b/RHEL6/input/profiles/CS2.xml index 35b88b5..3958779 100644 --- a/RHEL6/input/profiles/CS2.xml +++ b/RHEL6/input/profiles/CS2.xml @@ -19,8 +19,8 @@ - + + + - + diff --git a/RHEL6/input/system/accounts/session.xml b/RHEL6/input/system/accounts/session.xml index e500495..1d71938 100644 --- a/RHEL6/input/system/accounts/session.xml +++ b/RHEL6/input/system/accounts/session.xml @@ -11,7 +11,7 @@ correct configuration file permissions for interactive accounts, particularly those of privileged users such as root or system administrators. - Maximum concurrent login sessions Maximum number of concurrent sessions by a user @@ -24,7 +24,7 @@ operator="equals" interactive="0"> 20 - + Limit the Number of Concurrent Login Sessions Allowed Per User Limiting the number of allowed users and sessions per user can limit risks related to Denial of @@ -44,7 +44,7 @@ on the system: You should receive output similar to the following:
*		hard	maxlogins	10
- +
-- 1.7.1