Bug 232995

Summary:	FIPS 200: limit the number of concurrent sessions
Product:	Red Hat Enterprise Linux 4	Reporter:	Chris Runge <crunge>
Component:	pam	Assignee:	Tomas Mraz <tmraz>
Status:	CLOSED NEXTRELEASE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	4.0	Keywords:	FutureFeature
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Enhancement
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2008-04-04 11:53:43 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	232993
Bug Blocks:

Description Chris Runge 2007-03-19 19:55:03 UTC

+++ This bug was initially created as a clone of Bug #232993 +++

Requirement for FIPS 200

NIST 800-53
AC-10
The information system limits the number of concurrent sessions for any user to
[Assignment: organization-defined number of sessions].

see 
http://csrc.nist.gov/publications/nistpubs/800-53/SP800-53.pdf

According to sgrubb:

"Just checked with pam maintainer and he feels that pam_limits covers this one. 
I think we should have the rejection tied to the audit system. So, we are 
closer than I thought. It should work so that we can check that item off, but 
we can make it better."

Comment 1 Tomas Mraz 2008-04-04 11:53:43 UTC

pam_limits is in RHEL-4 already the rejects based on concurrent sessions are
just not explicitely audited -> closing as NEXTRELEASE as RHEL-5 is fixed.