# Ensure sshd MaxAuthTries is configured

Necessity: The 'MaxAuthTries' parameter specifies the maximum number of authentication attempts permitted per connection. Setting a low value is a critical defense mechanism against brute-force password-guessing attacks. If this value is set too high or left at its default (often 6), it provides attackers with a larger window to guess user credentials before the connection is terminated, significantly increasing the risk of a security breach.

Auditing and Remediation: The audit script directly queries the running SSH service's configuration to retrieve the current value of 'MaxAuthTries', ensuring an accurate reflection of the system's state. The remediation script modifies the '/etc/ssh/sshd_config' file to set the desired limit and then reloads the service, enforcing the new security policy without a full restart.

Recommended State Rationale:
- Basic ([4, 4]): This value is a widely accepted industry baseline, often recommended by benchmarks like CIS Level 1. It substantially hinders automated brute-force attacks compared to the default while providing a reasonable margin for legitimate user error.
- Moderate ([3, 3]): Lowering the attempt limit to 3 further strengthens security by reducing an attacker's opportunity to guess credentials in a single session, offering a better balance between security and usability.
- Strict ([1, 2]): This represents the most aggressive security posture. A value of 2 provides minimal tolerance for user error (e.g., a single password typo) but makes automated attacks extremely difficult. It is suitable for high-security environments where access is tightly controlled.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[6, 3]` |
| **Moderate** | `[4, 3]` |
| **Strict** | `[3, 3]` |
| **Type** | `RANGE` |

## Audit Script Working

Bash script that queries the active SSH daemon configuration for the 'MaxAuthTries' value. The script must use the 'sshd -T' command to ensure it reflects the running configuration and must output only the numerical value.

## Remediation Script Working

Bash script that accepts a single numerical value as a positional command-line argument. The script must set the 'MaxAuthTries' parameter in the '/etc/ssh/sshd_config' file to this value. If the parameter already exists (commented or not), it should be updated; otherwise, it should be added to the file. The script must then reload the sshd service to apply the change and output 'true' on success or 'false' on failure.

