diff --git a/README.md b/README.md index 18ab869..a5a764e 100644 --- a/README.md +++ b/README.md @@ -70,7 +70,8 @@ override['ssh-hardening']['ssh']['server']['listen_to'] = node['ipaddress'] * `['ssh-hardening']['ssh']['server']['use_privilege_separation']` - `nil` to calculate the best value based on server version, otherwise set `true` or `false` * `['ssh-hardening']['ssh']['server']['login_grace_time']` - `30s`. Time in which the login should be successfully, otherwise the user is disconnected. * `['ssh-hardening']['ssh']['server']['max_auth_tries']` - `2`. The number of authentication attempts per connection -* `['ssh-hardening']['ssh']['server']['max_sessions']` - `10` The number of sessions per connection +* `['ssh-hardening']['ssh']['server']['max_sessions']` - `10`. The number of sessions per connection +* `['ssh-hardening']['ssh']['server']['max_startups']` - `10:30:60`. The maximum number of concurrent unauthenticated connections to the SSH daemon. * `['ssh-hardening']['ssh']['server']['password_authentication']` - `false`. Set to `true` if password authentication should be enabled * `['ssh-hardening']['ssh']['server']['log_level']` - `verbose`. The log level of sshd. See `LogLevel` in `man 5 sshd_config` for possible values. * `['ssh-hardening']['ssh']['server']['sftp']['enable']` - `false`. Set to `true` to enable the SFTP feature of OpenSSH daemon diff --git a/attributes/default.rb b/attributes/default.rb index 3d5fdbc..6bd9418 100644 --- a/attributes/default.rb +++ b/attributes/default.rb @@ -113,6 +113,7 @@ server['login_grace_time'] = '30s' server['max_auth_tries'] = 2 server['max_sessions'] = 10 + server['max_startups'] = '10:30:60' server['password_authentication'] = false server['log_level'] = 'verbose' server['accept_env'] = ['LANG', 'LC_*', 'LANGUAGE'] diff --git a/templates/default/opensshd.conf.erb b/templates/default/opensshd.conf.erb index 69cca58..5bb6e34 100644 --- a/templates/default/opensshd.conf.erb +++ b/templates/default/opensshd.conf.erb @@ -95,7 +95,7 @@ PermitUserEnvironment no LoginGraceTime <%= @node['ssh-hardening']['ssh']['server']['login_grace_time'] %> MaxAuthTries <%= @node['ssh-hardening']['ssh']['server']['max_auth_tries'] %> MaxSessions <%= @node['ssh-hardening']['ssh']['server']['max_sessions'] %> -MaxStartups 10:30:100 +MaxStartups <%= @node['ssh-hardening']['ssh']['server']['max_startups'] %> # Enable public key authentication PubkeyAuthentication yes