# Ensure sshd MaxStartups is configured

Necessity: The 'MaxStartups' parameter specifies the maximum number of concurrent unauthenticated connections to the SSH daemon. This setting is crucial for mitigating brute-force password-guessing attacks and preventing Denial of Service (DoS) by resource exhaustion. If left unconfigured, an attacker could initiate a vast number of SSH connections, consuming server memory and CPU, potentially locking out legitimate administrators. The value is specified in a 'start:rate:full' format, which defines a rate-limiting mechanism for incoming connections. Auditing and Remediation: The audit script directly queries the SSH daemon's effective running configuration to determine the current value for 'maxstartups'. The remediation script modifies the '/etc/ssh/sshd_config' file to set the 'MaxStartups' directive to the desired value and then reloads the SSH service for the change to take effect. Recommended State Rationale: The states represent an increasing level of protection against connection-flooding attacks. Basic: ['10:30:100'] is a widely accepted baseline, often recommended by CIS benchmarks. It allows 10 initial unauthenticated connections, after which it begins randomly dropping new connections with a 30% probability, increasing linearly until the hard limit of 100 is reached. Moderate: ['10:30:80'] provides a more aggressive defense by lowering the maximum concurrent connection limit to 80. This forces the server to refuse all new connections sooner during a sustained attack. Strict: ['5:30:60'] offers the highest level of protection by significantly reducing the number of initial connections allowed to 5 and the overall maximum to 60. This is suitable for high-security environments where a rapid response to potential brute-force attempts is prioritized over accommodating high volumes of legitimate, simultaneous connection attempts.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['10:30:100']` |
| **Moderate** | `['10:30:80']` |
| **Strict** | `['5:30:60']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that queries the effective SSH daemon configuration for the 'maxstartups' setting. The script must use a command like `sshd -T | grep '^maxstartups' | awk '{print $2}'` to return only the value of this setting, without any descriptive text or labels.

## Remediation Script Working

Bash script that accepts a single positional command-line argument representing the desired value for the 'MaxStartups' setting (e.g., '10:30:100'). The script must modify the '/etc/ssh/sshd_config' file, setting 'MaxStartups' to the provided value. If the setting is commented out or already exists, it should be updated; if not, it should be added. After modifying the file, the script must restart the SSH service to apply the changes. The script must output 'true' on successful completion and 'false' if any step fails.

