Detections
Analytics

F5BI-AP-300001 - The F5 BIG-IP appliance providing user access control intermediary services must limit the "Max Sessions Per User" to one or an organization-defined number for each access profile.

Information

The "Max Sessions Per User" setting is crucial for maintaining session limits per individual user, preventing issues such as VDI applications disconnecting multiple users and becoming unusable for concurrent access. The default value for "Max Sessions Per User" is "0" (unlimited), so this setting must be set to implement a limit.

Solution

From the BIG-IP GUI:
1. Access.
2. Profiles/Policies.
3. Access Profiles.
4. Click the Name of the Access profile.
5. Under "Settings", set "Max Sessions per User" to "1" or to an organization-defined number.
6. Update.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_F5_BIG-IP_TMOS_Y26M07_STIG.zip

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-10, CAT|II, CCI|CCI-000054, Rule-ID|SV-266137r1212026_rule, STIG-ID|F5BI-AP-300001, Vuln-ID|V-266137

Plugin: F5

Control ID: 902ce3e9e5cca01e5f5b428ea74141915c3f38d037edafdfd5a72d03b227834e