Set SSH authentication attempt limit
Limit SSH authentication attempts per connection to 4 via MaxAuthTries.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
MaxAuthTries caps the number of authentication attempts allowed per connection before sshd drops it. The default (6) gives an attacker more guesses per session, easing brute-force and password-spraying attacks. Lowering it to 4 forces an attacker to open far more connections to make the same number of guesses, which is slower, noisier and easier to detect or rate-limit.
What Pavois checks
Pavois asserts that the effective sshd -T output reports maxauthtries 4. Reading the running daemon reflects the value after all Include directives and /etc/ssh/sshd_config.d/ drop-ins are merged, a file scan can miss an override and report a false pass or fail.
describe command('sshd -T') do
its('stdout') { should match(/^maxauthtries\s+[1-4]$/i) }
endHow to verify it is applied
Run sshd -T | grep -i maxauthtries. Expected output:
maxauthtries 4
Inspect & investigate
Failed and exhausted attempts appear in /var/log/auth.log (Debian/Ubuntu) or journalctl -u ssh / journalctl -u sshd (RHEL family). When the limit is hit you see error: maximum authentication attempts exceeded and a disconnect.
Remediation
Pavois's harden plan sets the sshd_setting resource for directive maxauthtries to 4, validates the candidate config with sshd -t, then notifies a reload of the ssh service. Apply it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| directive | maxauthtries |
|---|---|
| notify | action: reload, service: ssh.service |
| resource | sshd_setting |
| value | 3 |
| verify | sshd -t -f %{path} |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Note that sshd counts each public key the client offers as one attempt. A user whose agent holds many keys can hit the limit before the right key is tried and be rejected with Too many authentication failures. Before applying, prune unused keys from agents or set IdentitiesOnly yes for the target host, keep a second session open, and rely on the built-in sshd -t validation to avoid breaking the listener.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 2.2.6, 5.1.16, 5.1.18 | direct | per OS, see the benchmark table | high |
| PCI DSS | 2.2.6 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.