<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div><br><br><br></div><div><br>On Oct 3, 2013, at 4:06 PM, <a href="mailto:fcaviggi@redhat.com">fcaviggi@redhat.com</a> wrote:<br><br></div><blockquote type="cite"><div>
  
    <meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
  
  
    <div class="moz-cite-prefix">Shawn,<br>
      <br>
      This is probably a better approach - I'll resubmit the patch for&nbsp;
      accounts_max_concurrent_login_sessions - do you think we should
      probably do the same thing for disable_user_coredumps?<br>
      <br>
      -Frank<br>
      <br></div></div></blockquote><div><br></div><div>Yes, definitely!</div><div><br></div><br><blockquote type="cite"><div><div class="moz-cite-prefix">
      <br>
      <br>
      On 10/03/2013 02:25 PM, Shawn Wells wrote:<br>
    </div>
    <blockquote cite="mid:%3C524DB6A4.7050606@redhat.com%3E" type="cite">
      <meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
      <div class="moz-cite-prefix">On 10/3/13 1:08 PM, Frank Caviggia
        wrote:<br>
      </div>
      <blockquote cite="mid:20131003170811.GA30098@mail.corp.redhat.com" type="cite"><br>
        <fieldset class="mimeAttachmentHeader"><legend class="mimeAttachmentHeaderName">0001-Adding-remediation-fix-for-accounts_max_concurrent_l.patch</legend></fieldset>
        <br>
        <div class="moz-text-plain" wrap="true" graphical-quote="true" style="font-family: -moz-fixed; font-size: 12px;" lang="x-western">
          <pre wrap="">From 3616e7abaf9d9b1c71d211ff435c77ef96c297d3 Mon Sep 17 00:00:00 2001
From: Frank Caviggia <a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="mailto:fcaviggi@redhat.com">&lt;fcaviggi@redhat.com&gt;</a>
Date: Thu, 3 Oct 2013 12:48:54 -0400
Subject: [PATCH] Adding remediation fix for
 accounts_max_concurrent_login_sessions

Signed-off-by: Frank Caviggia <a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="mailto:fcaviggi@redhat.com">&lt;fcaviggi@redhat.com&gt;</a>
---
 RHEL6/input/fixes/bash/accounts_max_concurrent_login_sessions.sh | 4 ++++
 1 file changed, 4 insertions(+)
 create mode 100644 RHEL6/input/fixes/bash/accounts_max_concurrent_login_sessions.sh

diff --git a/RHEL6/input/fixes/bash/accounts_max_concurrent_login_sessions.sh b/RHEL6/input/fixes/bash/accounts_max_concurrent_login_sessions.sh
new file mode 100644
index 0000000..0ec1e06
--- /dev/null
+++ b/RHEL6/input/fixes/bash/accounts_max_concurrent_login_sessions.sh
@@ -0,0 +1,4 @@
+source ./templates/support.sh
+populate max_concurrent_login_sessions_value
+
+echo "*     hard   maxlogins    $max_concurrent_login_sessions_value" &gt;&gt; /etc/security/limits.conf
<div class="moz-txt-sig">-- 
1.8.3.1

</div></pre>
        </div>
      </blockquote>
      <br>
      There are two failure conditions which we'll need to remediate:<br>
      - maxlogins value to high<br>
      - maxlogins not set (which your patch handles)<br>
      <br>
      Here's an example of how to address both:<br>
      <a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://git.fedorahosted.org/cgit/scap-security-guide.git/tree/RHEL6/input/fixes/bash/accounts_password_minlen_login_defs.sh">https://git.fedorahosted.org/cgit/scap-security-guide.git/tree/RHEL6/input/fixes/bash/accounts_password_minlen_login_defs.sh</a><br>
      <br>
      A sed command will change any existing values, and should there
      not be any, the appropriate string is concatenated to the file.
      What do you think of that approach? I wasn't clever enough to get
      everything into a single one-liner, not sure if the efficiency
      could be increased.<br>
      <br>
      <br>
      <fieldset class="mimeAttachmentHeader"></fieldset>
      <br>
      <pre wrap="">_______________________________________________
scap-security-guide mailing list
<a class="moz-txt-link-abbreviated" href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a>
<a class="moz-txt-link-freetext" href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a>
</pre>
    </blockquote>
    <br>
    <br>
    <pre class="moz-signature" cols="72">-- 
Frank Caviggia
Consultant, Public Sector
<a class="moz-txt-link-abbreviated" href="mailto:fcaviggi@redhat.com">fcaviggi@redhat.com</a>
(M) (571) 295-4560</pre>
  

</div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>scap-security-guide mailing list</span><br><span><a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a></span><br><span><a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a></span><br></div></blockquote></body></html>