Detections
Analytics

5.1.17 Ensure sshd MaxAuthTries is configured

Information

The MaxAuthTries parameter specifies the maximum number of authentication attempts permitted per connection. When the login failure count reaches half the number, error messages will be written to the syslog file detailing the login failure.

Setting the MaxAuthTries parameter to a low number will minimize the risk of successful brute force attacks to the SSH server. While the recommended setting is 4, set the number based on site policy.

Solution

Edit the /etc/ssh/sshd_config file to set the MaxAuthTries parameter to 4 or less above any Include and Match entries as follows:

MaxAuthTries 4

Impact:

Lowering MaxAuthTries reduces the number of authentication attempts permitted per connection. Users whose clients try several keys before the correct one, or who mistype a passphrase, may reach the limit sooner and have to reconnect; set the value in line with site policy.

See Also

https://workbench.cisecurity.org/benchmarks/27891

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-3, 800-53|AU-3(1), 800-53|AU-7, 800-53|AU-12, CSCv7|16.13

Plugin: Unix

Control ID: 109af5f874be6d06e232994fa573e18e3156b4ace3291782c4653f45852a5559