[PATCH] Check needs to be reversed. As is, if you specified 10 as the maximum number of concurrent logins, it would allow 20.

Shawn Wells swells at redhat.com
Wed Aug 7 18:19:17 UTC 2013





On Aug 7, 2013, at 14:10, Maura Dailey <maura at eclipse.ncsc.mil> wrote:

> Self explanatory. I also added a test_attestation reference and corrected the comment for the external value.
> 
> - Maura Dailey
> 
> Signed-off-by: Maura Dailey <maura at eclipse.ncsc.mil>
> ---
> .../accounts_max_concurrent_login_sessions.xml     |    5 +++--
> 1 files changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/RHEL6/input/checks/accounts_max_concurrent_login_sessions.xml b/RHEL6/input/checks/accounts_max_concurrent_login_sessions.xml
> index eda8052..cb2e859 100644
> --- a/RHEL6/input/checks/accounts_max_concurrent_login_sessions.xml
> +++ b/RHEL6/input/checks/accounts_max_concurrent_login_sessions.xml
> @@ -7,6 +7,7 @@
>       </affected>
>       <description>The maximum number of concurrent login sessions per user should meet
>       minimum requirements.</description>
> +      <reference source="MED" ref_id="20130807" ref_url="test_attestation" />
>     </metadata>
>     <criteria comment="the value maxlogins should be set appropriately in /etc/security/limits.conf">
>       <criterion test_ref="test_maxlogins" />
> @@ -25,9 +26,9 @@
>   </ind:textfilecontent54_object>
> 
>   <ind:textfilecontent54_state id="state_maxlogins" version="1">
> -    <ind:subexpression operation="greater than or equal" var_ref="max_concurrent_login_sessions_value" datatype="int" />
> +    <ind:subexpression operation="less than or equal" var_ref="max_concurrent_login_sessions_value" datatype="int" />
>   </ind:textfilecontent54_state>
> 
> -  <external_variable comment="maximum password age" datatype="int" id="max_concurrent_login_sessions_value" version="1" />
> +  <external_variable comment="maximum number of concurrent logins per user" datatype="int" id="max_concurrent_login_sessions_value" version="1" />
> 
> </def-group>
> -- 
> 1.7.1



Ack



> 
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide


More information about the scap-security-guide mailing list