Limit the Number of Concurrent Login Sessions Allowed Per User
An XCCDF Rule
Description
Limiting the number of allowed users and sessions per user can limit risks related to Denial of
Service attacks. This addresses concurrent sessions for a single account and does not address
concurrent sessions by a single user via multiple accounts. To set the number of concurrent
sessions per user add the following line in /etc/security/limits.conf or
a file under /etc/security/limits.d/:
* hard maxlogins
Rationale
Limiting simultaneous user logins can insulate the system from denial of service problems caused by excessive logins. Automated login processes operating improperly or maliciously may result in an exceptional number of simultaneous login sessions.
- ID
- xccdf_org.ssgproject.content_rule_accounts_max_concurrent_login_sessions
- Severity
- Low
- References
- Updated