Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Default value for ssh_max_startups should be changed #366

Closed
joubbi opened this issue Dec 29, 2020 · 0 comments · Fixed by #368
Closed

Default value for ssh_max_startups should be changed #366

joubbi opened this issue Dec 29, 2020 · 0 comments · Fixed by #368

Comments

@joubbi
Copy link
Contributor

joubbi commented Dec 29, 2020

The default value for ssh_max_startups in the ssh_hardening role is '10:30:100'.
This same value is also the default for OpenSSHd.
If I have understood the manuals correctly, the default value is not doing any hardening at all.

Describe the solution you'd like
I would like the default value to be changed to 10:30:60.
This is the CIS level 1 recommendation.

Additional context
CIS CentOS 7 benchmark:

5.2.21 Ensure SSH MaxStartups is configured (Automated)
Profile Applicability:
 Level 1 - Server
 Level 1 - Workstation
Description:
The MaxStartups parameter specifies the maximum number of concurrent unauthenticated
connections to the SSH daemon.
Rationale:
To protect a system from denial of service due to a large number of pending authentication
connection attempts, use the rate limiting function of MaxStartups to protect availability of
sshd logins and prevent overwhelming the daemon.
Audit:
Run the following command and verify that output MaxStartups is 10:30:60 or matches
site policy:

# sshd -T -C user=root -C host="$(hostname)" -C addr="$(grep $(hostname)
/etc/hosts | awk '{print $1}')" | grep -i maxstartups
maxstartups 10:30:60

Remediation:
Edit the /etc/ssh/sshd_config file to set the parameter as follows:
maxstartups 10:30:60
Default Value:
MaxStartups 10:30:100

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants