The VMM must limit the number of concurrent sessions to ten for all accounts and/or account types.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-207345	SRG-OS-000027-VMM-000080	SV-207345r958398_rule		Medium

Description

VMM management includes the ability to control the number of users and user sessions that utilize the VMM. Limiting the number of allowed users and sessions per user is helpful in limiting risks related to DoS attacks. This requirement addresses concurrent sessions for VMM accounts and does not address concurrent sessions by single users via multiple VMM accounts. If the concurrent-session limitation of ten is insufficient to support operational requirements, it may be set to a higher value, but it must not be unlimited.

STIG	Date
Virtual Machine Manager Security Requirements Guide	2024-12-06

Details

Check Text (C-7602r365445_chk)

Verify the VMM limits the number of concurrent sessions to ten for all accounts and/or account types.

If it does not, this is a finding.

Fix Text (F-7602r365446_fix)

Configure the VMM to limit the number of concurrent sessions to ten for all accounts and/or account types.