How to manage failed logins in SSH

SSH server can be configured to allow an authenticating client several tries for a set period of time before the authentication is considered a failure. By default, an SSH user is allowed 3 attempts within 120 seconds (2 minutes) to authenticate, whereby the client will then be given the Permission denied error and the session closed.

SSH will log the failed login, and the user will then be allowed to log in again. Temporarily blocking failed SSH login might slow down malicious login attempts but will not deter brute-force attacks.

1. Launch terminal.
2. Open SSHd configuration file using your preferred text editor.

   $ sudo vi /etc/ssh/sshd_config
   [sudo] password for user:

3. Search for LoginGraceTime and set the value in seconds.

   LoginGraceTime 60

   Remove # if exist at the start of the line to uncomment.

   Can also use unit such as m for minute. Set the value to 0 to disable the feature.

   LoginGraceTime 1m

4. Search for MaxAuthTries and set the number of times authentication attempt is allowed.

   MaxAuthTries 5

   Remove # if exist at the start of the line to uncomment.

5. Restart ssh service for changes to take effect.

   $ sudo systemctl restart sshd

   Related: How to start, restart and stop SSH service