Rule ID
SV-256071r960735_rule
Version
V2R1
CCIs
Device management includes the ability to control the number of administrators and management sessions that manage a device. Limiting the number of allowed administrators and sessions per administrator based on account type, role, or access type is helpful in limiting risks related to denial-of-service (DOS) attacks. This requirement addresses concurrent sessions for administrative accounts and does not address concurrent sessions by a single administrator via multiple administrative accounts. The maximum number of concurrent sessions should be defined based on mission needs and the operational environment for each system. At a minimum, limits must be set for SSH, HTTPS, account of last resort, and root account sessions.
Go to Administration >> Account Management >> User Accounts. Click "Settings". Check under "Log-in Settings". If the "Allow only one log-in per user name/password combination" box is not checked, this is a finding.
Go to Administration >> Account Management >> User Accounts. Click "Settings". Under "Log-in Settings", check the "Allow only one log-in per user name/password combination" box. Click "OK" to save the settings.