SV-218059r603264: The system must limit users to 10 simultaneous system logins, or a site-defined number, in accordance with operational requirements. | Red Hat Enterprise Linux 6 Security Technical Implementation Guide

Loading benchmark…

Assessment Title

Rule Text

The system must limit users to 10 simultaneous system logins, or a site-defined number, in accordance with operational requirements.

Description

Discussion Text

Limiting simultaneous user logins can insulate the system from denial of service problems caused by excessive logins. Automated login processes operating improperly or maliciously may result in an exceptional number of simultaneous login sessions.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000054CCE-27457-1SV-50485V-38684

References

DPMS Target Red Hat Enterprise Linux 6 DISA DPMS Target Red Hat Enterprise Linux 6 4046

Checks

OVAL

oval:mil.disa.fso.redhat.rhel6:var:3266 ← xccdf_mil.disa.stig_value_var_accounts_max_concurrent_login_sessions

DISA STIG (Manual Reference)

Run the following command to ensure the "maxlogins" value is configured for all users on the system:

$ grep "maxlogins" /etc/security/limits.conf /etc/security/limits.d/*.conf

You should receive output similar to the following:

* hard maxlogins 10

If it is not similar, this is a finding.

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

#!/bin/bash
# Reconstructed from oval:mil.disa.fso.redhat.rhel6:def:112
# The system must limit users to 10 simultaneous system logins, or a site-defined number, in accordance with operational requirements.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.

# the value is an integer
# textfilecontent54_object (textfilecontent54_test)
test_1() {
  ( (sed -En 's/^[\s]*\*[\s]+(?:(?:hard)|(?:-))[\s]+maxlogins[\s]+([^#\s]+)\s*(?:#.*)?$/\1/p' '/etc/security/limits.conf') | grep -Pq '^\d+$' ) || ( (grep -rhP --include='*.conf' '^[\s]*\*[\s]+(?:(?:hard)|(?:-))[\s]+maxlogins[\s]+([^#\s]+)\s*(?:#.*)?$' '/etc/security/limits.d' | sed -En 's/^[\s]*\*[\s]+(?:(?:hard)|(?:-))[\s]+maxlogins[\s]+([^#\s]+)\s*(?:#.*)?$/\1/p') | grep -Pq '^\d+$' )
}
# the integer value is appropriate
# textfilecontent54_object (textfilecontent54_test)
test_2() {
  ( [ "$(sed -En 's/^[\s]*\*[\s]+(?:(?:hard)|(?:-))[\s]+maxlogins[\s]+([^#\s]+)\s*(?:#.*)?$/\1/p' '/etc/security/limits.conf')" -le 10 ] ) || ( [ "$(grep -rhP --include='*.conf' '^[\s]*\*[\s]+(?:(?:hard)|(?:-))[\s]+maxlogins[\s]+([^#\s]+)\s*(?:#.*)?$' '/etc/security/limits.d' | sed -En 's/^[\s]*\*[\s]+(?:(?:hard)|(?:-))[\s]+maxlogins[\s]+([^#\s]+)\s*(?:#.*)?$/\1/p')" -le 10 ] )
}

if ( test_1 && test_2 ); then
  echo "PASS"
else
  echo "FAIL"
fi

Assessment Script Powered by AISandbox-executed

A standalone Shell script to assess this control automatically. Review before running it in your environment.

Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.

#!/bin/sh
# OVAL Definition: oval:mil.disa.fso.redhat.rhel6:def:112
if [ ! -f "/etc/security/limits.conf" ]; then echo "PASS"; exit 0; fi
if grep -E "^[\s]*\\*[\s]+(?:(?:hard)|(?:-))[\s]+maxlogins[\s]+([^#\\s]+)\\s*(?:#.*)?$" /etc/security/limits.conf | awk '{if ($2 ~ /^[\s]*[0-9]+[\s]*$/) {if ($2 + 0 <= 10) print "PASS"; exit 0} else {print "FAIL"; exit 1}}'; then exit 0; else echo "FAIL"; exit 1; fi

Remediation

Limiting the number of allowed users and sessions per user can limit risks related to denial of service attacks. This addresses concurrent sessions for a single account and does not address concurrent sessions by a single user via multiple accounts. To set the number of concurrent sessions per user add the following line in "/etc/security/limits.conf": 

* hard maxlogins 10

A documented site-defined number may be substituted for 10 in the above.