# Ensure sshd MaxStartups is configured

The 'MaxStartups' parameter in the SSH daemon configuration specifies the maximum number of concurrent unauthenticated connections. The setting uses a 'start:rate:full' format. This is critical for preventing denial-of-service (DoS) and brute-force attacks. If not configured properly, an attacker could initiate a large number of SSH connections, exhausting server resources and preventing legitimate users from accessing the system. The audit script checks the currently configured value in '/etc/ssh/sshd_config'. The remediation script modifies this file to set the desired value and reloads the SSH service. The recommended state of '10:30:60' is based on the CIS (Center for Internet Security) benchmark. It allows 10 initial unauthenticated connections, then starts dropping 30% of subsequent connections until a hard limit of 60 is reached. This value provides a strong defense against connection-flooding attacks without being overly restrictive for most environments, making it suitable for Basic, Moderate, and Strict security postures.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['10:30:60']` |
| **Moderate** | `['10:30:60']` |
| **Strict** | `['10:30:60']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that queries the active SSH daemon configuration for the 'MaxStartups' setting. The script must parse the configuration and return only the configured value (e.g., '10:30:60'). If the setting is not explicitly defined, it should return the system's default value.

## Remediation Script Working

Bash script that accepts a single positional command-line argument representing the desired 'MaxStartups' value (e.g., '10:30:60'). The script must update the '/etc/ssh/sshd_config' file with this new value, either by modifying the existing line or adding it if it does not exist. After updating the file, the script must reload the sshd service to apply the change. It must return 'true' on success and 'false' on failure.

