TMA-COS-5.1.21
Ensure SSH MaxStartups is configured
Description
The MaxStartups parameter specifies the maximum number of concurrent unauthenticated connections to the SSH daemon. To protect a system from denial of service due to a large number of pending authentication connection attempts, use the rate limiting function of MaxStartups to protect availability of sshd logins and prevent overwhelming the daemon.
How it is checked
Audit method: Manual review
This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.
Run the following command and verify that output MaxStartups is 10:30:60 or matches site policy: # sshd -T | grep -i maxstartups # maxstartups 10:30:60
How it is fixed
Fix method: Guidance or infrastructure patch
Edit the /etc/ssh/sshd_config file to set the parameter as follows: maxstartups 10:30:60
Properties
- Operating systems
- Any
- Tags
- container-optimized-oscosssh
- Reference
- CIS Google Container-Optimized OS Benchmark v1.2.0 - 5.1.21 Ensure SSH MaxStartups is configured