v0.32.0

essentials revision 5: a new SSH check in ES-04 (read this if you waive essentials controls)

ES-04 is now "SSH limits attempts, time and features" and includes the new check ssh.login-grace-time, written by @sarankumar1325 (first contribution, thank you!): LoginGraceTime has to be between 1 and 60 seconds (a parameter). The OpenSSH default of 120 and 0 (no limit) fail. On a live host the value comes from sshd -T, which prints seconds; on a mounted root a plain number is read as seconds and a value with a unit such as 1m reports ERROR rather than a guess.

What you have to do: a waiver of a control of essentials names the revision it was written for, so those waivers stop applying until you write them again for revision: 5 (the scan lists them and says so). A stock OpenSSH already failed ES-04 (MaxAuthTries defaults to 6); a host you hardened for MaxAuthTries and X11Forwarding now also needs LoginGraceTime 60. Waivers of single checks, and everything under kisa-2026, are not affected.

Changelog

Features

• d1b8f8c feat: essentials revision 5: ssh.login-grace-time in ES-04 (#262)
• 4ea75dc feat: ssh.login-grace-time: a client has little time to log in (#259)

Verify

checksums.txt has the SHA-256 of every file here and is signed with Sigstore by this
repository's release workflow:

cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-identity "https://github.com/with-developer/vmsctl/.github/workflows/release.yml@refs/tags/v0.32.0" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c checksums.txt

Build provenance: gh attestation verify <file> --repo with-developer/vmsctl.