Enable Secure Mode

To protect SSH options, you can do the following:

• Set LoginGraceTime to 60 so that the server disconnects a user if they have not successfully logged in after 60 seconds.
• Set MaxSessions to 5, to limit the number of multiplexed SSH sessions that can be present on a single SSH session. Session multiplexing allows you to set up a single master connection that all other connections to the same host can use or reuse. Limiting the maximum number of multiplexed SSH sessions has no effect on port forwarding, on the SOCKS proxy, or on your ability to connect again to the same host through a new network connection. Use a PrivilegeSeparation sandbox, which is specific to connection multiplexing, to help prevent privilege escalation by containing an attacker within the unprivileged process.
• Set MaxAuthTries to 2, to limit the maximum number of authentication attempts permitted per connection. The default is 6.
• Set Compression to No to disable compression.
• Set TCPKeepAlive to No to ensure that messages are sent on an encrypted channel.
• Set X11Forwarding to No to disable remote display forwarding.
• Set AllowTcpForwarding to No to prevent all TCP forwarding.

After you make these modifications, the SSH service restarts, and all other users are disconnected from the SSH shell.

Secure mode enforces the following rules to harden the password scheme for shell users:

• Dictionary passwords are not allowed.
• When a user changes passwords, the last 10 passwords are not allowed.
• Passwords generated by non-admin users expire every 30 days.
• After a user resets a password, they cannot reset it for 24 hours.
• All system accounts cannot log in using SSH.
• Password length must be 8 characters, and the password must contain at least one uppercase letter, one special character, and one number.
• A new password cannot match the old password.