[PATCH] Check needs to be reversed. As is, if you specified 10 as the maximum number of concurrent logins, it would allow 20.

Maura Dailey maura at eclipse.ncsc.mil
Wed Aug 7 18:10:04 UTC 2013


Self explanatory. I also added a test_attestation reference and corrected the comment for the external value.

- Maura Dailey

Signed-off-by: Maura Dailey <maura at eclipse.ncsc.mil>
---
 .../accounts_max_concurrent_login_sessions.xml     |    5 +++--
 1 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/RHEL6/input/checks/accounts_max_concurrent_login_sessions.xml b/RHEL6/input/checks/accounts_max_concurrent_login_sessions.xml
index eda8052..cb2e859 100644
--- a/RHEL6/input/checks/accounts_max_concurrent_login_sessions.xml
+++ b/RHEL6/input/checks/accounts_max_concurrent_login_sessions.xml
@@ -7,6 +7,7 @@
       </affected>
       <description>The maximum number of concurrent login sessions per user should meet
       minimum requirements.</description>
+      <reference source="MED" ref_id="20130807" ref_url="test_attestation" />
     </metadata>
     <criteria comment="the value maxlogins should be set appropriately in /etc/security/limits.conf">
       <criterion test_ref="test_maxlogins" />
@@ -25,9 +26,9 @@
   </ind:textfilecontent54_object>
 
   <ind:textfilecontent54_state id="state_maxlogins" version="1">
-    <ind:subexpression operation="greater than or equal" var_ref="max_concurrent_login_sessions_value" datatype="int" />
+    <ind:subexpression operation="less than or equal" var_ref="max_concurrent_login_sessions_value" datatype="int" />
   </ind:textfilecontent54_state>
 
-  <external_variable comment="maximum password age" datatype="int" id="max_concurrent_login_sessions_value" version="1" />
+  <external_variable comment="maximum number of concurrent logins per user" datatype="int" id="max_concurrent_login_sessions_value" version="1" />
 
 </def-group>
-- 
1.7.1



More information about the scap-security-guide mailing list