# Ensure sshd MaxAuthTries is configured

Necessity: The 'MaxAuthTries' parameter specifies the maximum number of authentication attempts permitted per connection. If this value is set too high, it allows an attacker to conduct a brute-force password guessing attack more efficiently by trying many passwords over a single connection. Limiting the number of attempts significantly slows down such attacks, increasing the likelihood of detection and reducing the chance of a successful compromise.

Auditing and Remediation: The audit script directly queries the running SSH service configuration to determine the currently enforced value for 'maxauthtries'. The remediation script modifies the '/etc/ssh/sshd_config' file to set the 'MaxAuthTries' parameter to the desired value and then restarts the SSH service to ensure the new configuration is applied.

Recommended State Rationale:
- Basic ([6, 6]): This state provides a baseline defense against casual or unsophisticated brute-force attacks while being permissive enough to avoid locking out legitimate users who may mistype their password a few times.
- Moderate ([4, 4]): This is a widely recommended value, often cited in security benchmarks like CIS. It strikes a strong balance between security and usability, making brute-force attacks significantly more difficult without being overly restrictive for authorized users.
- Strict ([3, 3]): This state offers the highest level of protection by providing a minimal window for authentication attempts. It is best suited for high-security environments where the risk of a breach outweighs the potential inconvenience of a legitimate user being disconnected after a few failed attempts.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[6, 3]` |
| **Moderate** | `[4, 3]` |
| **Strict** | `[3, 3]` |
| **Type** | `RANGE` |

## Audit Script Working

Bash script that queries the active SSH daemon configuration for the 'maxauthtries' value. The script must parse the output to return only the numerical value and nothing else.

## Remediation Script Working

Bash script that takes a single numerical value as a positional command-line argument. The script must find the 'MaxAuthTries' line in '/etc/ssh/sshd_config', update its value to the one provided, or add the line if it does not exist. After modifying the file, the script must restart the SSH service to apply the change. It must return 'true' if the operation is successful and 'false' otherwise.

