+++ This bug was initially created as a clone of Bug #232993 +++ Requirement for FIPS 200 NIST 800-53 AC-10 The information system limits the number of concurrent sessions for any user to [Assignment: organization-defined number of sessions]. see http://csrc.nist.gov/publications/nistpubs/800-53/SP800-53.pdf According to sgrubb: "Just checked with pam maintainer and he feels that pam_limits covers this one. I think we should have the rejection tied to the audit system. So, we are closer than I thought. It should work so that we can check that item off, but we can make it better."
pam_limits is in RHEL-4 already the rejects based on concurrent sessions are just not explicitely audited -> closing as NEXTRELEASE as RHEL-5 is fixed.