SOL-11.1-040500 - The operating system must limit the number of concurrent sessions for each account to an organization-defined number of sessions.

Information

Limiting the number of allowed users and sessions per user can limit risks related to denial of service attacks. The organization may define the maximum number of concurrent sessions for an information system account globally, by account type, by account, or by a combination thereof.

This requirement addresses concurrent sessions for a single information system account and does not address concurrent sessions by a single user via multiple accounts.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Identify the organizational requirements for maximum number of sessions and which users must be restricted. If there are no requirements to limit concurrent sessions, this item does not apply.

The Project Management profile is required.

For each user requiring concurrent session restrictions, add the user to the special user.[username] project where [username] is the user's account username where [MAX] is equal to the organizational requirement.

# pfexec projadd -K 'project.max-tasks=(privileged,[MAX],deny)' user.[username]

Determine the project membership for the user.

# projects [username]

If the user is a member of any projects other than default, group.[groupname], or user.[username], remove that project from the user's account.

The root role is required.

# pfedit /etc/user_attr

Locate the line containing the user's username. Remove any project=[projectname] entries from the fifth field.

# pfedit /etc/project

Locate the line containing the user's username in a project other than default, group.[groupname], or user.[username], and remove the user from the project's entry or entries from the fourth field.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_SOL_11_x86_V3R1_STIG.zip

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-10, CAT|III, CCI|CCI-000054, Rule-ID|SV-216130r958398_rule, STIG-ID|SOL-11.1-040500, STIG-Legacy|SV-61023, STIG-Legacy|V-48151, Vuln-ID|V-216130

Plugin: Unix

Control ID: 67c438094b896c587790027e6e14252309ce1cd1b1e394006e755f0a035e1d60