Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I configure a new server right now and ask myself what is the internally effect if I set MaxAuthTries=1 in sshd_config. The server only accept key authentication an no root logins.

Has this setting any effect to prevent brute force logins?

Is there any effect more than closing the tcp socket after MaxAuthTries wrong authentications? Maybe some internal blacklisting for a period or stuff?

share|improve this question

1 Answer 1

up vote 3 down vote accepted

MaxAuthTries

Specifies the maximum number of authentication attempts permitted per connection. Once the number of failures reaches half this value, additional failures are logged. The default is 6.

Man page

Setting the value to 1 will mean that your server will only allow 1 login attempt before locking you out.

share|improve this answer
    
If I got the man page right is the only effect that sshd close the tcp socket after MaxAuthTries wrong connection tries. I thing this is no great security benefit :-D –  OkieOth Sep 11 '13 at 13:28
2  
@OkieOth It slows brute force attacks –  Ray Britton Sep 11 '13 at 13:34
4  
It also annoys your users if they have keys and/or other authentication methods ;-) Each method counts as an "attempt" of course. (One workaround is a suitable Host stanza in ~/.ssh/config.) As sshd just drops the connection, it only makes it marginally more time consuming for an attacker, leaving other more effective defence layers such as TCP connection rate limiting to kick in. –  mr.spuratic Sep 11 '13 at 14:19
    
@Terry today I found the special behavior related to the syslog you mentioned. That's really nice ... if MaxAuthTries=1 and log level is INFO every login failure is logged in /var/log/auth ... good for fail2ban :-D –  OkieOth Sep 13 '13 at 9:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.