metadata/service/server/cis/cis-5-2-13.yml

# 5.2.13 Ensure SSH LoginGraceTime is set to one minute or less (Scored)
#
# Profile Applicability
# ---------------------
# - Level 1 - Server
# - Level 1 - Workstation
#
# Description
# -----------
# The LoginGraceTime parameter specifies the time allowed for successful authentication to
# the SSH server. The longer the Grace period is the more open unauthenticated connections
# can exist. Like other session controls in this session the Grace Period should be limited to
# appropriate organizational limits to ensure the service is available for needed access.
#
# Rationale
# ---------
# Setting the LoginGraceTime parameter to a low number will minimize the risk of
# successful brute force attacks to the SSH server. It will also limit the number of concurrent
# unauthenticated connections While the recommended setting is 60 seconds (1 Minute), set
# the number based on site policy.
#
# Audit
# -----
# Run the following command and verify that output LoginGraceTime is 60 or less:
#
#   # grep "^LoginGraceTime" /etc/ssh/sshd_config
#   LoginGraceTime 60
#
# Remediation
# -----------
# Edit the /etc/ssh/sshd_config file to set the parameter as follows:
#
#   LoginGraceTime 60

parameters:
  openssh:
    server:
      login_grace_time: 60