LowSSHBLWK-SSH-011

SSH allows an excessive number of authentication attempts per connection

What this means

MaxAuthTries is set to ‹max auth tries› in sshd_config — well above the recommended ceiling of 3-6. A high limit gives an online password-guessing attempt many more tries per TCP connection before being cut off.

How to fix it

Set MaxAuthTries 3 (or up to 6) in /etc/ssh/sshd_config and run systemctl restart sshd.

Check it yourself

Run a scan and look for BLWK-SSH-011 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads sshd_config and reports this check when:

max_auth_tries > 6

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• CIS Benchmark 5.2.7
• MITRE ATT&CK T1110

Related checks

• SSH password authentication is enabled · BLWK-SSH-001
• SSH root login is permitted · BLWK-SSH-002
• SSH allows empty passwords · BLWK-SSH-003
• SSH X11 forwarding is enabled · BLWK-SSH-004
• SSH TCP forwarding/tunneling is enabled · BLWK-SSH-005
• SSH permits user-set environment variables · BLWK-SSH-006