[PATCH 1/9] Added Rule to set the maximum amount of concurrent login sessions per user. Mapped rule to CCI-000054 which requires the operating system to limit the number of concurrent sessions for each account.
Signed-off-by: Willy Santos <wsantos(a)redhat.com>
---
rhel6/src/input/system/accounts/session.xml | 31 +++++++++++++++++++++++++++
1 files changed, 31 insertions(+), 0 deletions(-)
diff --git a/rhel6/src/input/system/accounts/session.xml
b/rhel6/src/input/system/accounts/session.xml
index 00b5a8d..7a31235 100644
--- a/rhel6/src/input/system/accounts/session.xml
+++ b/rhel6/src/input/system/accounts/session.xml
@@ -168,6 +168,17 @@ operator="equals" interactive="0">
<value selector="077">077</value>
</Value>
+<Value id="max_concurrent_login_sessions_value" type="number"
+operator="equals" interactive="0">
+<title>Maximum concurrent login sessions</title>
+<description>Maximum number of concurrent sessions by a user</description>
+<value selector="">10</value>
+<value selector="5">5</value>
+<value selector="10">10</value>
+<value selector="15">15</value>
+<value selector="20">20</value>
+</Value>
+
<Rule id="user_umask_bashrc">
<title>
Ensure the Default Bash Umask is Set Correctly
@@ -241,4 +252,24 @@ written to by unauthorized users.</rationale>
</Group>
+<Rule id="max_concurrent_login_sessions">
+<title>
+Set the number of concurrent login sessions allowed per user
+</title>
+<description>
+Limiting the number of allowed users and sessions per user can limit risks related to
Denial of
+Service attacks. This addresses concurrent sessions for a single account and does not
address
+concurrent sessions by a single user via multiple accounts. To set the number of
concurrent
+sessions per user add the following line in
<tt>/etc/security/limits.conf</tt>:
+<pre>* hard maxlogins <i>MAX</i></pre>
+Where <i>MAX</i> is the maximum number of login sessions allowed.
+</description>
+<rationale>Limiting simultaneous user logins can insulate the system from denial of
service
+problems caused by excessive logins. Automated login processes operating improperly or
+maliciously may result in an exceptional number of simultaneous login sessions.
+</rationale>
+<!-- <oval id="max_concurrent_login_sessions"
value="max_concurrent_login_sessions_value" /> -->
+<ref disa="54"/>
+</Rule>
+
</Group>
--
1.7.7.6