topic Re: Allow a single user logon for each session via GUI/SSH in General Topics

Allow a single user logon for each session via GUI/SSH

Kevin_Ncs — Mon, 10 Jul 2023 14:53:40 GMT

hi All,

I want to check when each admin account logs into its own session via GUI and SSH.
If either one login to a 2nd session then it will be denied.

Is it achievable? I can't find any article from Palo Alto regards to this.

Re: Allow a single user logon for each session via GUI/SSH

reaper — Mon, 10 Jul 2023 15:14:09 GMT

No, admins are allowed to log in multiple times

you can limit their idle timeout in "device > setup > management > authentication settings" if you're worried they have too many 'sleeping' sessions open

Re: Allow a single user logon for each session via GUI/SSH

Kevin_Ncs — Mon, 10 Jul 2023 15:15:30 GMT

Does this article works?

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000kEhWCAU&lang=en_US%E2%80%A9

Re: Allow a single user logon for each session via GUI/SSH

BPry — Tue, 11 Jul 2023 13:11:57 GMT

@Kevin_Ncs,

The option works perfectly fine, however I'd really caution thinking through setting this value to 1.

Admin sessions are tracked whenever they access the GUI/CLI/API; so say that you have an admin who is making a change in the GUI and loses access to the device due to the change, if restricted to a single session they've now effectively locked out of the device. You'll be waiting for the established session to be removed prior to it allowing access via another session.

Re: Allow a single user logon for each session via GUI/SSH

J.Kim530884 — Mon, 09 Sep 2024 16:17:08 GMT

We had max session count set to 3. FIPS standard is 4.
We have 2 administrators and we constantly lock ourselves out of the PA when we are more actively engaged.
Session Count default is 0(Unlimited) and Session Time default is 0 which translate to 30 days.