STIGQter STIGQter: STIG Summary: Solaris 11 SPARC Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 23 Apr 2021:

The operating system must limit the number of concurrent sessions for each account to an organization-defined number of sessions.

DISA Rule

SV-216367r603267_rule

Vulnerability Number

V-216367

Group Title

SRG-OS-000027

Rule Version

SOL-11.1-040500

Severity

CAT III

CCI(s)

Weight

10

Fix Recommendation

Identify the organizational requirements for maximum number of sessions and which users must be restricted. If there are no requirements to limit concurrent sessions, this item does not apply.

The Project Management profile is required.

For each user requiring concurrent session restrictions, add the user to the special user.[username] project where [username] is the user's account username where [MAX] is equal to the organizational requirement.

# pfexec projadd -K 'project.max-tasks=(privileged,[MAX],deny)' user.[username]

Determine the project membership for the user.

# projects [username]

If the user is a member of any projects other than default, group.[groupname], or user.[username], remove that project from the user's account.

The root role is required.

# pfedit /etc/user_attr

Locate the line containing the user's username. Remove any project=[projectname] entries from the fifth field.

# pfedit /etc/project

Locate the line containing the user's username in a project other than default, group.[groupname], or user.[username], and remove the user from the project's entry or entries from the fourth field.

Check Contents

Identify the organizational requirements for maximum number of sessions and which users must be restricted. If there are no requirements to limit concurrent sessions, this item does not apply.

For each user requiring concurrent session restrictions, determine if that user is in the user.[username] project where [username] is the user's account username.

# projects [username] | grep user

If the output does not include the project user.[username], this is a finding.

Determine the project membership for the user.

# projects [username]

If the user is a member of any project other than default, group.[groupname], or user.[username], this is a finding.

Determine whether the max-tasks resource control is enabled properly.

# projects -l user.[username] | grep attribs

If the output does not include the text:

attribs: project.max-tasks=(privileged,[MAX],deny)

where [MAX] is the organization-defined maximum number of concurrent sessions, this is a finding.

Vulnerability Number

V-216367

Documentable

False

Rule Version

SOL-11.1-040500

Severity Override Guidance

Identify the organizational requirements for maximum number of sessions and which users must be restricted. If there are no requirements to limit concurrent sessions, this item does not apply.

For each user requiring concurrent session restrictions, determine if that user is in the user.[username] project where [username] is the user's account username.

# projects [username] | grep user

If the output does not include the project user.[username], this is a finding.

Determine the project membership for the user.

# projects [username]

If the user is a member of any project other than default, group.[groupname], or user.[username], this is a finding.

Determine whether the max-tasks resource control is enabled properly.

# projects -l user.[username] | grep attribs

If the output does not include the text:

attribs: project.max-tasks=(privileged,[MAX],deny)

where [MAX] is the organization-defined maximum number of concurrent sessions, this is a finding.

Check Content Reference

M

Target Key

4022

Comments