<div dir="ltr">I'm up for both. <br><br><br></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Mon, Sep 30, 2013 at 11:41 AM, Shawn Wells <span dir="ltr"><<a href="mailto:shawn@redhat.com" target="_blank">shawn@redhat.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000"><div class="im">
<div>On 9/30/13 11:28 AM,
<a href="mailto:fcaviggi@redhat.com" target="_blank">fcaviggi@redhat.com</a> wrote:<br>
</div>
<blockquote type="cite"> All,<br>
<br>
Most of the guidance for RHEL security has suggested setting the
following in /etc/security/limits.conf:<br>
<br>
* hard core 0<br>
<br>
I have generally set this to:<br>
<br>
* - core 0<br>
<br>
Because this sets both the hard and soft limits on the system.
Most SCAP scanners are looking for very specific values there.
I'm looking at modifying the checks to pass either 'hard' or '-'
for the value.<br>
<br>
I'd also to fix the maxlogins in the rule (<strong>max_concurrent_login_sessions</strong>)
in /etc/security/limits.conf to look for the DOD default (10) and
lower to satisfy the check. Security standards are there as a
baseline, why 'fail' the setting for exceeding the baseline value?<br>
</blockquote>
<br></div>
Good call. Make a patch.
</div>
<br>_______________________________________________<br>
scap-security-guide mailing list<br>
<a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
<br></blockquote></div><br><br clear="all"><br>-- <br><div><a href="http://leamhall.blogspot.com/" target="_blank">Mind on a Mission</a></div>
</div>