Fun with limits.conf

Shawn Wells shawn at redhat.com
Mon Sep 30 15:41:53 UTC 2013


On 9/30/13 11:28 AM, fcaviggi at redhat.com wrote:
> All,
>
> Most of the guidance for RHEL security has suggested setting the 
> following in /etc/security/limits.conf:
>
>         *    hard    core    0
>
> I have generally set this to:
>
>         *    -    core    0
>
> Because this sets both the hard and soft limits on the system. Most 
> SCAP scanners are looking for very specific values there. I'm looking 
> at modifying the checks to pass either 'hard' or '-' for the value.
>
> I'd also to fix the maxlogins in the rule 
> (*max_concurrent_login_sessions*) in /etc/security/limits.conf to look 
> for the DOD default (10) and lower to satisfy the check. Security 
> standards are there as a baseline, why 'fail' the setting for 
> exceeding the baseline value?

Good call. Make a patch.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130930/44cc4899/attachment.html>


More information about the scap-security-guide mailing list