documentation_complete: true

title: 'Limit the Number of Concurrent Login Sessions Allowed Per User'

description: |-
    Limiting the number of allowed users and sessions per user can limit risks related to Denial of Service attacks.
    This addresses concurrent sessions for a single account and does not address concurrent sessions by a single user via multiple accounts.
    To set the number of concurrent sessions per user add the following line in <tt>/etc/security/limits.conf</tt>:
    <pre>* hard maxlogins <sub idref="var_accounts_max_concurrent_login_sessions" /></pre>

rationale: |-
    Limiting simultaneous user logins can insulate the system from denial of service problems caused by excessive logins.
    Automated login processes operating improperly or maliciously may result in an exceptional number of simultaneous login sessions.

severity: low

ocil_clause: 'maxlogins is not equal to or less than the expected value'

ocil: |-
    Run the following command to ensure the <tt>maxlogins</tt> value is configured for all users on the system:
    <pre># grep "maxlogins" /etc/security/limits.conf</pre>
    You should receive output similar to the following:
    <pre>*          hard    maxlogins       <sub idref="var_accounts_max_concurrent_login_sessions" /></pre>
