TMA-SOLARIS-6.12
Limit Consecutive Login Attempts for SSH
Description
The 'MaxAuthTries' parameter in the /etc/ssh/sshd_config file specifies the maximum number of authentication attempts permitted per connection. By restricting the number of failed authentication attempts before the server terminates the connection, malicious users are blocked from gaining access to the host by using repetitive brute-force login exploits. Audit: MaxAuthTries must be 6 or less, or commented out (default 6).
How it is checked
Audit method: File pattern
- File
/etc/ssh/sshd_config- Pattern
(?m)^\s*MaxAuthTries\s+([7-9]|[1-9][0-9]+)\b
How it is fixed
Fix method: Guidance or infrastructure patch
Perform the following to implement the recommended state: # awk '/MaxAuthTries/ { $1 = "MaxAuthTries"; $2 = "6" } { print }' /etc/ssh/sshd_config > /etc/ssh/sshd_config.CIS # mv /etc/ssh/sshd_config.CIS /etc/ssh/sshd_config # svcadm restart svc:/network/ssh
Properties
- Operating systems
- Any
- Tags
- solarisssh
- Reference
- CIS Oracle Solaris 11.4 Benchmark v1.1.0 - 6.12 Limit Consecutive Login Attempts for SSH
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
tmaegis scan --target solaris