# Ensure sshd MaxSessions is configured

Necessity: The 'MaxSessions' parameter specifies the maximum number of open shell, login, or subsystem (e.g., sftp) sessions permitted per network connection. Limiting this value is a crucial defense against Denial of Service (DoS) attacks. A malicious or compromised user account could otherwise open an excessive number of sessions, consuming server memory and CPU resources, potentially rendering the system unresponsive and unavailable for legitimate users. Misconfiguration leaves the system vulnerable to resource exhaustion attacks. Auditing and Remediation: The audit script inspects the '/etc/ssh/sshd_config' file to determine the currently configured value for 'MaxSessions', returning the default of 10 if it's not explicitly set. The remediation script directly modifies this configuration file to set 'MaxSessions' to a specified value and then restarts the SSH service to ensure the new limit is enforced. Recommended State Rationale: Basic: '[10, 10]' represents the default OpenSSH configuration. It provides a baseline level of protection but may be too permissive for environments concerned about resource abuse. Moderate: '[4, 4]' is a common best-practice recommendation (e.g., from CIS benchmarks). This value strikes a balance between security and usability, allowing users enough concurrent sessions for typical tasks (e.g., an interactive shell and a file transfer) while significantly reducing the risk of resource exhaustion. Strict: '[2, 2]' is intended for high-security environments where user activity must be tightly controlled. This restrictive setting minimizes the potential impact of a DoS attack from a single connection but may hinder users who rely on multiple simultaneous sessions for complex workflows.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[10, 2]` |
| **Moderate** | `[4, 2]` |
| **Strict** | `[2, 2]` |
| **Type** | `RANGE` |

## Audit Script Working

Bash script that queries the /etc/ssh/sshd_config file for the MaxSessions setting. The script should parse the file to find the uncommented MaxSessions value. If the value is not explicitly set, the script should return the default value of '10'. The output must be only the numeric value, with no additional text or formatting.

## Remediation Script Working

Bash script that accepts a single numerical argument to set the MaxSessions value in the /etc/ssh/sshd_config file. The script must find the MaxSessions line (commented or uncommented), replace it with the new setting, or append it if it does not exist. After updating the file, the script must restart the sshd service to apply the changes. The script must return 'true' if the operation is successful and 'false' otherwise.

