The system must limit users to 10 simultaneous system logins, or a site-defined number, in accordance with operational requirements.

From Red Hat Enterprise Linux 6 Security Technical Implementation Guide

Associated with: CCI-000054

SV-50485r2_rule The system must limit users to 10 simultaneous system logins, or a site-defined number, in accordance with operational requirements.

Vulnerability discussion

Limiting simultaneous user logins can insulate the system from denial of service problems caused by excessive logins. Automated login processes operating improperly or maliciously may result in an exceptional number of simultaneous login sessions.

Check content

Run the following command to ensure the "maxlogins" value is configured for all users on the system: $ grep "maxlogins" /etc/security/limits.conf /etc/security/limits.d/*.conf You should receive output similar to the following: * hard maxlogins 10 If it is not similar, this is a finding.

Fix text

Limiting the number of allowed users and sessions per user can limit risks related to denial of service attacks. This addresses concurrent sessions for a single account and does not address concurrent sessions by a single user via multiple accounts. To set the number of concurrent sessions per user add the following line in "/etc/security/limits.conf": * hard maxlogins 10 A documented site-defined number may be substituted for 10 in the above.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.