Detections
Analytics

5.1.18 Ensure sshd MaxStartups is configured

Information

The MaxStartups parameter specifies the maximum number of concurrent unauthenticated connections to the SSH daemon.

To protect a system from denial of service due to a large number of pending authentication connection attempts, use the rate limiting function of MaxStartups to protect availability of sshd logins and prevent overwhelming the daemon.

Solution

Edit the /etc/ssh/sshd_config file to set the MaxStartups parameter to 10:30:60 or more restrictive above any Include entries as follows:

MaxStartups 10:30:60

Impact:

Tightening MaxStartups causes the daemon to begin randomly dropping new unauthenticated connections earlier as concurrent connection attempts rise. On hosts that legitimately receive many simultaneous connections, tune the value so that authorized clients are not dropped under normal load.

See Also

https://workbench.cisecurity.org/benchmarks/27892

Item Details

Category: CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION

References: 800-53|CM-1, 800-53|CM-2, 800-53|CM-6, 800-53|CM-7, 800-53|IA-5

Plugin: Unix

Control ID: 6d88ae7fc70a09d63124af55bca5707dd574387a87d1f1010904ade33cd3407d