← All rules
SOCLE-CLD-SSH-027// SSHmediumeffective runtime

Set SSH MaxSessions limit

Cap the number of multiplexed sessions per SSH connection at 10 via MaxSessions.

Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.

A pass proves✓ running now✓ on disk✓ survives rebootthe qualified verdict →
Debian 12CIS 1.1.0Debian 13CIS 1.0.0FedoraRHEL 10 / Rocky 10 / AlmaLinux 10RHEL 8 / Rocky 8 / AlmaLinux 8CIS 4.0.0RHEL 9 / Rocky 9 / AlmaLinux 9CIS 2.0.0Ubuntu 22.04CIS 3.0.0Ubuntu 24.04CIS 1.0.0Ubuntu 26.04
One check, maps to 2 standards

Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.

A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.

Why this rule matters

MaxSessions bounds how many open shell, login or subsystem channels may be multiplexed over a single SSH connection. Without a sane cap, a client (or an attacker abusing a foothold) can open a large number of concurrent sessions on one connection and consume daemon resources, threatening the availability of legitimate logins. Setting it to 10 keeps normal multiplexing usable while preventing channel-flood denial-of-service.

What Pavois checks

Pavois asserts that the effective sshd -T output reports maxsessions 10. Reading the live daemon reflects the value after all Include directives and /etc/ssh/sshd_config.d/ drop-ins are merged, a file scan can miss an override and report a false result.

describe command('sshd -T') do
  its('stdout') { should match(/^maxsessions\s+([1-9]|10)$/i) }
end

How to verify it is applied

Run sshd -T | grep -i maxsessions. Expected output:

  • maxsessions 10

Inspect & investigate

Session and channel activity is logged in /var/log/auth.log (Debian/Ubuntu) or journalctl -u ssh / journalctl -u sshd (RHEL family). Refused extra channels are reported as error: no more sessions to the client.

Remediation

Pavois's harden plan sets the sshd_setting resource for directive maxsessions to 10, validates the candidate config with sshd -t, then notifies a reload of the ssh service. Apply it with pavois harden apply.

Pavois applies this with its own harden engine, the plan below, not a shell script:

directivemaxsessions
notifyaction: reload, service: ssh.service
resourcesshd_setting
value2
verifysshd -t -f %{path}
pavois harden plan local

where the target is local, a user@host SSH alias, or a container , Docs

Impact & precautions

A limit of 10 is generous for interactive use, but workflows that rely heavily on connection multiplexing (e.g. ControlMaster/ControlPersist, IDE remote sessions, parallel scp/sftp over one connection, Ansible with pipelining) can exceed it and see new channels refused. Review such tooling before applying, raise the value if a legitimate workload needs more, keep a second session open, and rely on the built-in sshd -t validation.

Standards mapping

StandardReferenceTypeVersionConfidence
CIS2.2.6, 5.1.17, 5.1.18, 5.1.19directper OS, see the benchmark tablehigh
PCI DSS2.2.6supporting4.0.1medium

Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.

Sources & references