# Ensure sshd MaxSessions is configured

The `MaxSessions` parameter in the SSH daemon configuration specifies the maximum number of open shell, login, or subsystem sessions permitted per network connection. Limiting this value is a crucial security measure to prevent resource exhaustion and denial-of-service (DoS) attacks. If a malicious actor gains access to an account, they could attempt to open a vast number of sessions, consuming server memory and CPU resources, which could lead to system instability or crash the SSH service, preventing legitimate administrative access. The audit script checks the currently configured value in `/etc/ssh/sshd_config`, while the remediation script modifies this file to enforce a specific limit and restarts the SSH service. The recommended states are designed to incrementally enhance security: a Basic state of `[10, 10]` aligns with the common default, providing a baseline defense. The Moderate state of `[4, 4]` significantly tightens this control, suitable for most production servers by limiting the potential impact of a compromised account. The Strict state of `[2, 2]` is for high-security environments, severely restricting concurrent sessions to minimize the attack surface and enforce disciplined administrative practices.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[10, 2]` |
| **Moderate** | `[4, 2]` |
| **Strict** | `[2, 2]` |
| **Type** | `RANGE` |

## Audit Script Working

Bash script that queries the `MaxSessions` setting from the `/etc/ssh/sshd_config` file. The script should parse the active configuration, handling commented lines appropriately. If the setting is not explicitly configured, it should return the default value of `10`. The script must output only the final numerical value.

## Remediation Script Working

Bash script that sets the `MaxSessions` value in the `/etc/ssh/sshd_config` file. The script must accept the desired numerical value as a single, positional command-line argument. It should find and update the existing `MaxSessions` line or add it if it does not exist. After modifying the file, the script must restart the `sshd` service to apply the change. The script must output `true` on success and `false` on failure.

