<div dir="ltr">Sorry for the double post. I just wanted to make sure that the presence of the 'soft' line didn't throw an error.</div><div class="gmail_extra"><br><br><div class="gmail_quote">On Sat, Oct 5, 2013 at 9:35 PM, Trevor Vaughan <span dir="ltr"><<a href="mailto:tvaughan@onyxpoint.com" target="_blank">tvaughan@onyxpoint.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">As a note, both:<div><br></div><div>* - core 0</div><div><br></div><div>AND</div><div><br></div><div>
* hard core 0</div><div>* soft core 0</div><div><br></div><div>Should pass.</div><div><br></div><div>
Trevor</div></div><div class="gmail_extra"><br><br><div class="gmail_quote"><div><div class="h5">On Mon, Sep 30, 2013 at 11:28 AM, <span dir="ltr"><<a href="mailto:fcaviggi@redhat.com" target="_blank">fcaviggi@redhat.com</a>></span> wrote:<br>
</div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="h5">
<div bgcolor="#FFFFFF" text="#000000">
All,<br>
<br>
Most of the guidance for RHEL security has suggested setting the
following in /etc/security/limits.conf:<br>
<br>
* hard core 0<br>
<br>
I have generally set this to:<br>
<br>
* - core 0<br>
<br>
Because this sets both the hard and soft limits on the system. Most
SCAP scanners are looking for very specific values there. I'm
looking at modifying the checks to pass either 'hard' or '-' for the
value.<br>
<br>
I'd also to fix the maxlogins in the rule (<strong>max_concurrent_login_sessions</strong>)
in /etc/security/limits.conf to look for the DOD default (10) and
lower to satisfy the check. Security standards are there as a
baseline, why 'fail' the setting for exceeding the baseline value?<br>
<br>
Regards,<br>
<br>
Frank Caviggia<span><font color="#888888"><br>
<br>
<pre cols="72">--
Frank Caviggia
Consultant, Public Sector
<a href="mailto:fcaviggi@redhat.com" target="_blank">fcaviggi@redhat.com</a>
(M) <a href="tel:%28571%29%20295-4560" value="+15712954560" target="_blank">(571) 295-4560</a></pre>
</font></span></div>
<br></div></div><div class="im">_______________________________________________<br>
scap-security-guide mailing list<br>
<a href="mailto:scap-security-guide@lists.fedorahosted.org" target="_blank">scap-security-guide@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
<br></div></blockquote></div><span class="HOEnZb"><font color="#888888"><br><br clear="all"><div><br></div>-- <br>Trevor Vaughan<br>Vice President, Onyx Point, Inc<br><a href="tel:%28410%29%20541-6699" value="+14105416699" target="_blank">(410) 541-6699</a><br>
<a href="mailto:tvaughan@onyxpoint.com" target="_blank">tvaughan@onyxpoint.com</a><br><br>-- This account not approved for unencrypted proprietary information --
</font></span></div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br>Trevor Vaughan<br>Vice President, Onyx Point, Inc<br>(410) 541-6699<br><a href="mailto:tvaughan@onyxpoint.com">tvaughan@onyxpoint.com</a><br><br>-- This account not approved for unencrypted proprietary information --
</div>