Other Articles

Servers – Ensure SSH Login Grace Time is Configured

Support > Fixing Checks > Server

06 March, 2026

This check ensures that SSH Login Grace Time is properly configured on the server.

A high login grace time allows unauthenticated connections to remain open for longer periods, increasing the risk of brute force attacks and resource exhaustion.

Check Details

  • Resource: Server
  • Check: Ensure SSH LoginGraceTime is set to one minute or less
  • Risk: Long authentication windows can increase exposure to brute force attacks and allow multiple unauthenticated sessions.

Remediation Steps

  1. Open a terminal session with root or sudo privileges.

  2. Verify current SSH LoginGraceTime setting:

    sshd -T | grep -i logingracetime
  3. Ensure the value is set between 1 and 60 seconds.

  4. Edit SSH configuration file:

    sudo nano /etc/ssh/sshd_config

  5. Add or modify the following line:

    LoginGraceTime 60
  6. Save the file and exit.

  7. Restart SSH service:

    sudo systemctl restart sshd
  8. Re-run the audit command to confirm configuration.
  9. Perform regular audits to ensure compliance.