Fun with limits.conf

fcaviggi at redhat.com fcaviggi at redhat.com
Sun Oct 6 03:25:34 UTC 2013


Trevor,

The hard and '-' (which sets both hard and soft) are the primary 
controls, 'soft' is overruled by the 'hard' setting.

That's why those are the most important to check.

Regards,

Frank



On 10/05/2013 09:35 PM, Trevor Vaughan wrote:
> Sorry for the double post. I just wanted to make sure that the 
> presence of the 'soft' line didn't throw an error.
>
>
> On Sat, Oct 5, 2013 at 9:35 PM, Trevor Vaughan <tvaughan at onyxpoint.com 
> <mailto:tvaughan at onyxpoint.com>> wrote:
>
>     As a note, both:
>
>     *  -  core  0
>
>     AND
>
>     *  hard  core 0
>     *  soft   core 0
>
>     Should pass.
>
>     Trevor
>
>
>     On Mon, Sep 30, 2013 at 11:28 AM, <fcaviggi at redhat.com
>     <mailto:fcaviggi at redhat.com>> wrote:
>
>         All,
>
>         Most of the guidance for RHEL security has suggested setting
>         the following in /etc/security/limits.conf:
>
>                 *    hard    core    0
>
>         I have generally set this to:
>
>                 *    -    core    0
>
>         Because this sets both the hard and soft limits on the system.
>         Most SCAP scanners are looking for very specific values
>         there.  I'm looking at modifying the checks to pass either
>         'hard' or '-' for the value.
>
>         I'd also to fix the maxlogins in the rule
>         (*max_concurrent_login_sessions*) in /etc/security/limits.conf
>         to look for the DOD default (10) and lower to satisfy the
>         check. Security standards are there as a baseline, why 'fail'
>         the setting for exceeding the baseline value?
>
>         Regards,
>
>         Frank Caviggia
>
>         -- 
>         Frank Caviggia
>         Consultant, Public Sector
>         fcaviggi at redhat.com  <mailto:fcaviggi at redhat.com>
>         (M)(571) 295-4560  <tel:%28571%29%20295-4560>
>
>
>         _______________________________________________
>         scap-security-guide mailing list
>         scap-security-guide at lists.fedorahosted.org
>         <mailto:scap-security-guide at lists.fedorahosted.org>
>         https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>
>
>
>
>     -- 
>     Trevor Vaughan
>     Vice President, Onyx Point, Inc
>     (410) 541-6699 <tel:%28410%29%20541-6699>
>     tvaughan at onyxpoint.com <mailto:tvaughan at onyxpoint.com>
>
>     -- This account not approved for unencrypted proprietary
>     information --
>
>
>
>
> -- 
> Trevor Vaughan
> Vice President, Onyx Point, Inc
> (410) 541-6699
> tvaughan at onyxpoint.com <mailto:tvaughan at onyxpoint.com>
>
> -- This account not approved for unencrypted proprietary information --


-- 
Frank Caviggia
Consultant, Public Sector
fcaviggi at redhat.com
(M) (571) 295-4560

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20131005/027638cd/attachment.html>


More information about the scap-security-guide mailing list