[PATCH 1/9] Added Rule to set the maximum amount of concurrent login sessions per user. Mapped rule to CCI-000054 which requires the operating system to limit the number of concurrent sessions for each account.

Willy Santos wsantos at redhat.com
Wed Jun 20 00:04:51 UTC 2012


Signed-off-by: Willy Santos <wsantos at redhat.com>
---
 rhel6/src/input/system/accounts/session.xml |   31 +++++++++++++++++++++++++++
 1 files changed, 31 insertions(+), 0 deletions(-)

diff --git a/rhel6/src/input/system/accounts/session.xml b/rhel6/src/input/system/accounts/session.xml
index 00b5a8d..7a31235 100644
--- a/rhel6/src/input/system/accounts/session.xml
+++ b/rhel6/src/input/system/accounts/session.xml
@@ -168,6 +168,17 @@ operator="equals" interactive="0">
 <value selector="077">077</value>
 </Value>
 
+<Value id="max_concurrent_login_sessions_value" type="number"
+operator="equals" interactive="0">
+<title>Maximum concurrent login sessions</title>
+<description>Maximum number of concurrent sessions by a user</description>
+<value selector="">10</value>
+<value selector="5">5</value>
+<value selector="10">10</value>
+<value selector="15">15</value>
+<value selector="20">20</value>
+</Value>
+
 <Rule id="user_umask_bashrc">
 <title>
 Ensure the Default Bash Umask is Set Correctly
@@ -241,4 +252,24 @@ written to by unauthorized users.</rationale>
 
 </Group>
 
+<Rule id="max_concurrent_login_sessions">
+<title>
+Set the number of concurrent login sessions allowed per user
+</title>
+<description>
+Limiting the number of allowed users and sessions per user can limit risks related to Denial of 
+Service attacks. This addresses concurrent sessions for a single account and does not address 
+concurrent sessions by a single user via multiple accounts. To set the number of concurrent
+sessions per user add the following line in <tt>/etc/security/limits.conf</tt>:
+<pre>* hard maxlogins <i>MAX</i></pre>
+Where <i>MAX</i> is the maximum number of login sessions allowed.
+</description>
+<rationale>Limiting simultaneous user logins can insulate the system from denial of service 
+problems caused by excessive logins. Automated login processes operating improperly or 
+maliciously may result in an exceptional number of simultaneous login sessions.
+</rationale>
+<!-- <oval id="max_concurrent_login_sessions" value="max_concurrent_login_sessions_value" /> -->
+<ref disa="54"/>
+</Rule>
+
 </Group>
-- 
1.7.7.6



More information about the scap-security-guide mailing list