<div dir="ltr">I just found the relevant code and have no worries.<div><br></div><div>Thanks for the response!</div><div><br></div><div>Trevor</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Sat, Oct 5, 2013 at 11:25 PM, <span dir="ltr"><<a href="mailto:fcaviggi@redhat.com" target="_blank">fcaviggi@redhat.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000">
<div>Trevor,<br>
<br>
The hard and '-' (which sets both hard and soft) are the primary
controls, 'soft' is overruled by the 'hard' setting.<br>
<br>
That's why those are the most important to check.<br>
<br>
Regards,<br>
<br>
Frank<div><div class="h5"><br>
<br>
<br>
<br>
On 10/05/2013 09:35 PM, Trevor Vaughan wrote:<br>
</div></div></div><div><div class="h5">
<blockquote type="cite">
<div dir="ltr">Sorry for the double post. I just wanted to make
sure that the presence of the 'soft' line didn't throw an error.</div>
<div class="gmail_extra"><br>
<br>
<div class="gmail_quote">On Sat, Oct 5, 2013 at 9:35 PM, Trevor
Vaughan <span dir="ltr"><<a href="mailto:tvaughan@onyxpoint.com" target="_blank">tvaughan@onyxpoint.com</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">As a note, both:
<div><br>
</div>
<div>* - core 0</div>
<div><br>
</div>
<div>AND</div>
<div><br>
</div>
<div>
* hard core 0</div>
<div>* soft core 0</div>
<div><br>
</div>
<div>Should pass.</div>
<div><br>
</div>
<div>
Trevor</div>
</div>
<div class="gmail_extra"><br>
<br>
<div class="gmail_quote">
<div>
<div>On Mon, Sep 30, 2013 at 11:28 AM, <span dir="ltr"><<a href="mailto:fcaviggi@redhat.com" target="_blank">fcaviggi@redhat.com</a>></span>
wrote:<br>
</div>
</div>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div>
<div>
<div bgcolor="#FFFFFF" text="#000000"> All,<br>
<br>
Most of the guidance for RHEL security has
suggested setting the following in
/etc/security/limits.conf:<br>
<br>
* hard core 0<br>
<br>
I have generally set this to:<br>
<br>
* - core 0<br>
<br>
Because this sets both the hard and soft limits
on the system. Most SCAP scanners are looking
for very specific values there. I'm looking at
modifying the checks to pass either 'hard' or
'-' for the value.<br>
<br>
I'd also to fix the maxlogins in the rule (<strong>max_concurrent_login_sessions</strong>)
in /etc/security/limits.conf to look for the DOD
default (10) and lower to satisfy the check.
Security standards are there as a baseline, why
'fail' the setting for exceeding the baseline
value?<br>
<br>
Regards,<br>
<br>
Frank Caviggia<span><font color="#888888"><br>
<br>
<pre cols="72">--
Frank Caviggia
Consultant, Public Sector
<a href="mailto:fcaviggi@redhat.com" target="_blank">fcaviggi@redhat.com</a>
(M) <a href="tel:%28571%29%20295-4560" value="+15712954560" target="_blank">(571) 295-4560</a></pre>
</font></span></div>
<br>
</div>
</div>
<div>_______________________________________________<br>
scap-security-guide mailing list<br>
<a href="mailto:scap-security-guide@lists.fedorahosted.org" target="_blank">scap-security-guide@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
<br>
</div>
</blockquote>
</div>
<span><font color="#888888"><br>
<br clear="all">
<div><br>
</div>
-- <br>
Trevor Vaughan<br>
Vice President, Onyx Point, Inc<br>
<a href="tel:%28410%29%20541-6699" value="+14105416699" target="_blank">(410) 541-6699</a><br>
<a href="mailto:tvaughan@onyxpoint.com" target="_blank">tvaughan@onyxpoint.com</a><br>
<br>
-- This account not approved for unencrypted
proprietary information --
</font></span></div>
</blockquote>
</div>
<br>
<br clear="all">
<div><br>
</div>
-- <br>
Trevor Vaughan<br>
Vice President, Onyx Point, Inc<br>
<a href="tel:%28410%29%20541-6699" value="+14105416699" target="_blank">(410) 541-6699</a><br>
<a href="mailto:tvaughan@onyxpoint.com" target="_blank">tvaughan@onyxpoint.com</a><br>
<br>
-- This account not approved for unencrypted proprietary
information --
</div>
</blockquote>
<br>
<br>
<pre cols="72">--
Frank Caviggia
Consultant, Public Sector
<a href="mailto:fcaviggi@redhat.com" target="_blank">fcaviggi@redhat.com</a>
(M) <a href="tel:%28571%29%20295-4560" value="+15712954560" target="_blank">(571) 295-4560</a></pre>
</div></div></div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br>Trevor Vaughan<br>Vice President, Onyx Point, Inc<br>(410) 541-6699<br><a href="mailto:tvaughan@onyxpoint.com">tvaughan@onyxpoint.com</a><br><br>-- This account not approved for unencrypted proprietary information --
</div>