Skip to content

5.1.13 Ensure sshd LoginGraceTime is configured

Audit#

Run the following command and verify that output LoginGraceTime is between 1 and 60 seconds: 

# sshd -T | grep logingracetime
logingracetime 60

Remediation#

Edit the /etc/ssh/sshd_config file to set the LoginGraceTime parameter to 60 seconds or less above any Include entry as follows: 

LoginGraceTime 60
Note: First occurrence of a option takes precedence. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location.

Default Value: LoginGraceTime 120