# Ensure sshd LoginGraceTime is configured

The 'LoginGraceTime' parameter specifies the time in seconds that the SSH server waits for a client to successfully authenticate after establishing a connection. If the user fails to log in within this timeframe, the server disconnects. Setting a low grace period is crucial for mitigating security risks. A long grace period allows an attacker more time to attempt password guessing in a brute-force attack and can be used in denial-of-service attacks by opening many connections and leaving them in the pre-authentication phase, consuming server resources. The audit script checks the currently active 'LoginGraceTime' value by querying the running SSH daemon's configuration. The remediation script directly modifies the '/etc/ssh/sshd_config' file to set the desired value and restarts the service for the change to take effect. The Basic state of 60 seconds aligns with CIS benchmarks, providing a reasonable window for legitimate users. The Moderate state of 30 seconds significantly shortens the attack window, enhancing security. The Strict state of 15 seconds provides a very small window, which is highly effective against automated attacks and suitable for environments where authentication is expected to be fast.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[60, 15]` |
| **Moderate** | `[30, 15]` |
| **Strict** | `[15, 15]` |
| **Type** | `RANGE` |

## Audit Script Working

Bash script that queries the active SSH daemon configuration for the 'LoginGraceTime' value. The script must use 'sshd -T' to get the running configuration and output only the numeric value representing the time in seconds.

## Remediation Script Working

Bash script that accepts a single positional argument, an integer representing the desired 'LoginGraceTime' in seconds. The script must update the '/etc/ssh/sshd_config' file by either modifying the existing 'LoginGraceTime' line or adding it if it does not exist. After updating the file, the script must restart the SSH service to apply the change. It should return 'true' on successful completion and 'false' on failure.

