MaxAuthTries

MaxAuthTries is an SSH daemon configuration option that restricts the number of authentication attempts a single connection may perform before the connection is terminated. It is part of the OpenSSH server configuration and is set in the sshd_config file.

The setting works by counting each failed authentication attempt for a given connection. When the counter reaches the value of MaxAuthTries, the server closes the connection. The default value in many installations is 6, though it can be adjusted to suit security and usability needs. The limit applies per connection, not per user or per IP address.

MaxAuthTries applies to all authentication methods offered by SSH during that connection, including password, public key, keyboard-interactive, and host-based authentication. It can help mitigate brute-force attacks by limiting rapid successive attempts, but it may affect legitimate users on unstable networks or those who have recently changed credentials. If the limit is reached, a new connection will be required to attempt authentication again.

Configuration and related considerations: MaxAuthTries is configured in sshd_config and accepts integer values. Choosing a value involves balancing security with user convenience. Administrators often consider it alongside related controls such as MaxSessions (limits on concurrent sessions per connection), MaxStartups (limits on unauthenticated connections), and LoginGraceTime, as well as external protections like fail2ban to block repeated abusive attempts.