Add max_startup parameter

Signed-off-by: Emmanuel CARRE <[email protected]>

Author: emmanuelCarre

README.md

@@ -70,7 +70,8 @@ override['ssh-hardening']['ssh']['server']['listen_to'] = node['ipaddress']
 * `['ssh-hardening']['ssh']['server']['use_privilege_separation']` - `nil` to calculate the best value based on server version, otherwise set `true` or `false`
 * `['ssh-hardening']['ssh']['server']['login_grace_time']` - `30s`. Time in which the login should be successfully, otherwise the user is disconnected.
 * `['ssh-hardening']['ssh']['server']['max_auth_tries']` - `2`. The number of authentication attempts per connection
-* `['ssh-hardening']['ssh']['server']['max_sessions']` - `10` The number of sessions per connection
+* `['ssh-hardening']['ssh']['server']['max_sessions']` - `10`. The number of sessions per connection
+* `['ssh-hardening']['ssh']['server']['max_startups']` - `10:30:100`. The maximum number of concurrent unauthenticated connections to the SSH daemon.
 * `['ssh-hardening']['ssh']['server']['password_authentication']` - `false`. Set to `true` if password authentication should be enabled
 * `['ssh-hardening']['ssh']['server']['log_level']` - `verbose`. The log level of sshd. See `LogLevel` in `man 5 sshd_config` for possible values.
 * `['ssh-hardening']['ssh']['server']['sftp']['enable']` - `false`. Set to `true` to enable the SFTP feature of OpenSSH daemon

attributes/default.rb

@@ -113,6 +113,7 @@
   server['login_grace_time']         = '30s'
   server['max_auth_tries']           = 2
   server['max_sessions']             = 10
+  server['max_startups']             = '10:30:100'
   server['password_authentication']  = false
   server['log_level']                = 'verbose'
   server['accept_env']               = ['LANG', 'LC_*', 'LANGUAGE']

templates/default/opensshd.conf.erb

@@ -95,7 +95,7 @@ PermitUserEnvironment no
 LoginGraceTime <%= @node['ssh-hardening']['ssh']['server']['login_grace_time'] %>
 MaxAuthTries <%= @node['ssh-hardening']['ssh']['server']['max_auth_tries'] %>
 MaxSessions <%= @node['ssh-hardening']['ssh']['server']['max_sessions'] %>
-MaxStartups 10:30:100
+MaxStartups <%= @node['ssh-hardening']['ssh']['server']['max_startups'] %>
 
 # Enable public key authentication
 PubkeyAuthentication yes