Fun with limits.conf

Trevor Vaughan tvaughan at onyxpoint.com
Sun Oct 6 03:53:35 UTC 2013


I just found the relevant code and have no worries.

Thanks for the response!

Trevor


On Sat, Oct 5, 2013 at 11:25 PM, <fcaviggi at redhat.com> wrote:

>  Trevor,
>
> The hard and '-' (which sets both hard and soft) are the primary controls,
> 'soft' is overruled by the 'hard' setting.
>
> That's why those are the most important to check.
>
> Regards,
>
> Frank
>
>
>
>
> On 10/05/2013 09:35 PM, Trevor Vaughan wrote:
>
> Sorry for the double post. I just wanted to make sure that the presence of
> the 'soft' line didn't throw an error.
>
>
> On Sat, Oct 5, 2013 at 9:35 PM, Trevor Vaughan <tvaughan at onyxpoint.com>wrote:
>
>> As a note, both:
>>
>>  *  -  core  0
>>
>>  AND
>>
>>  *  hard  core 0
>> *  soft   core 0
>>
>>  Should pass.
>>
>>  Trevor
>>
>>
>>  On Mon, Sep 30, 2013 at 11:28 AM, <fcaviggi at redhat.com> wrote:
>>
>>>   All,
>>>
>>> Most of the guidance for RHEL security has suggested setting the
>>> following in /etc/security/limits.conf:
>>>
>>>         *    hard    core    0
>>>
>>> I have generally set this to:
>>>
>>>         *    -    core    0
>>>
>>> Because this sets both the hard and soft limits on the system. Most SCAP
>>> scanners are looking for very specific values there.  I'm looking at
>>> modifying the checks to pass either 'hard' or '-' for the value.
>>>
>>> I'd also to fix the maxlogins in the rule (*
>>> max_concurrent_login_sessions*) in /etc/security/limits.conf to look
>>> for the DOD default (10) and lower to satisfy the check. Security standards
>>> are there as a baseline, why 'fail' the setting for exceeding the baseline
>>> value?
>>>
>>> Regards,
>>>
>>> Frank Caviggia
>>>
>>> --
>>> Frank Caviggia
>>> Consultant, Public Sectorfcaviggi at redhat.com
>>> (M) (571) 295-4560
>>>
>>>
>>>  _______________________________________________
>>> scap-security-guide mailing list
>>> scap-security-guide at lists.fedorahosted.org
>>> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>>>
>>>
>>
>>
>>  --
>> Trevor Vaughan
>> Vice President, Onyx Point, Inc
>> (410) 541-6699
>> tvaughan at onyxpoint.com
>>
>> -- This account not approved for unencrypted proprietary information --
>>
>
>
>
>  --
> Trevor Vaughan
> Vice President, Onyx Point, Inc
> (410) 541-6699
> tvaughan at onyxpoint.com
>
> -- This account not approved for unencrypted proprietary information --
>
>
>
> --
> Frank Caviggia
> Consultant, Public Sectorfcaviggi at redhat.com
> (M) (571) 295-4560
>
>


-- 
Trevor Vaughan
Vice President, Onyx Point, Inc
(410) 541-6699
tvaughan at onyxpoint.com

-- This account not approved for unencrypted proprietary information --
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20131005/dfcd36e0/attachment.html>


More information about the scap-security-guide mailing list