Other Articles

Servers – Configure SSH MaxStartups

Secure Configuration Checks > Server

This check ensures that SSH MaxStartups parameter is properly configured to limit the number of concurrent unauthenticated connections.

Misconfigured or unlimited connections can expose the server to brute-force attacks and denial-of-service (DoS) conditions. Proper configuration helps protect SSH service availability.

Check Details

  • Resource: Server
  • Check: Ensure SSH MaxStartups is configured
  • Risk: Unrestricted unauthenticated connections can lead to brute-force attacks or denial-of-service (DoS).

Remediation Steps

  1. Open a terminal session with root or sudo privileges.

  2. Verify current MaxStartups configuration:

    sshd -T | grep -i maxstartups

  3. Ensure the output is set to:

    maxstartups 10:30:60

  4. Edit SSH configuration file:

    sudo nano /etc/ssh/sshd_config

  5. Add or modify the MaxStartups parameter:

    MaxStartups 10:30:60
  6. Save the file and exit.

  7. Restart SSH service:

    sudo systemctl restart sshd
  8. Re-run the audit command to confirm the configuration is applied.
  9. Perform regular audits to ensure the setting remains compliant.

Updated on 06 March, 2026