mediumaccess-controlverified ✓rollback-safe

Limit SSH maximum concurrent sessions

ssh-max-sessions · RHEL ≥ 8 · 2 impls

Description

The SSH daemon must limit the number of concurrent sessions permitted per network connection. MaxSessions controls session multiplexing, which allows multiple logical sessions over a single TCP connection.

Rationale

Unlimited session multiplexing allows a single authenticated connection to spawn many sessions, which can be used to amplify the impact of a compromised credential. An attacker with one valid login can open numerous simultaneous sessions for parallel data exfiltration or to consume system resources.

Check → Remediate

Checkcommand

val=$(sshd -T 2>/dev/null | grep -i '^maxsessions ' | awk '{print $2}')
if [ -z "$val" ]; then echo "FAIL: maxsessions not found"; exit 1; fi
if [ "$val" -lt 1 ] || [ "$val" -gt {{ ssh_max_sessions }} ]; then
  echo "FAIL: maxsessions=$val (expected 1-{{ ssh_max_sessions }})"
  exit 1
fi
echo "OK: maxsessions=$val"

expected_exit:: 0

Remediateconfig_set

path:: /etc/ssh/sshd_config
key:: MaxSessions
value:: {{ ssh_max_sessions }}
separator:
reload:: sshd

Framework references

CIS

rhel10 5.1.18rhel8 5.1.19rhel9 5.1.18

NIST 800-53

AC-10CM-6

Live verification

rhel10:checkrhel8:checkrhel9:check

#ssh#session-management