# Ensure sshd LoginGraceTime is configured

The 'LoginGraceTime' parameter specifies the time allowed for a client to successfully complete authentication after connecting to the SSH server. If this value is too high, it can allow an attacker to keep connections open for an extended period without authenticating, potentially leading to a denial-of-service (DoS) attack by exhausting available connection slots. The audit script checks the currently configured grace period by querying the SSH daemon's effective configuration. The remediation script directly modifies the 'sshd_config' file to enforce a specific timeout value and reloads the service. The Basic state of 60 seconds aligns with CIS benchmarks as a fundamental security measure. The Moderate state of 30 seconds provides a better security posture by halving the attack window. The Strict state of 15 seconds or less is recommended for high-security environments, as it gives attackers a minimal amount of time to perform pre-authentication attacks, though it may impact users on high-latency networks.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[60, 15]` |
| **Moderate** | `[30, 15]` |
| **Strict** | `[15, 15]` |
| **Type** | `RANGE` |

## Audit Script Working

bash script that queries the effective SSH server configuration for the 'LoginGraceTime' setting and returns only its numeric value in seconds. The script should parse the output of 'sshd -T' to ensure it retrieves the active, merged configuration value.

## Remediation Script Working

bash script that accepts a single numeric value as a positional command-line argument. The script must modify the '/etc/ssh/sshd_config' file to set 'LoginGraceTime' to the provided value. If the setting already exists (commented or not), it should be updated; otherwise, it should be added to the file. The script must then restart the sshd service to apply the change and return 'true' on success or 'false' on failure.

