Concurrent Login

[sugardaddyz]

Hi guys,

Recently our security team has flagged out the below:

A single user account is permitted to login repeatedly to maintain multiple active sessions at a time. Concurrent sessions increase the chances of a user being unable to detect whether his account has been compromised. It also allows an attacker who has gained access once to perpetuate his session, as he will not be logged out upon a valid logon by a legitimate user.


Is there a way to disable concurrent logon?

[scottwilkerson]

Is there a way to disable concurrent logon?

Sorry, there is no such feature in Nagios Core

[sugardaddyz]

Is this feature available in Nagios XI?

[scottwilkerson]

In XI there is some session management where you can set session expiration as well as Admins can view sessions opened, IP addresses that are connected to the session, and take actions (like killing the session)