Scenario

The developer account dev has been locked out of the server. Security logs indicate the SSH daemon's authentication failure limit was triggered.

Task

Check the logs to count exactly how many times the user failed today. Update the SSH configuration to increase the allowed login attempts above that number.

Example

root@server:~# tail /var/log/auth.log
Dec 23 09:12:01 server sshd[2201]: Failed password for dev from 10.0.0.5 port 5432 ssh2
Dec 23 09:12:05 server sshd[2201]: Failed password for dev from 10.0.0.5 port 5432 ssh2
Dec 23 09:12:08 server sshd[2201]: Failed password for dev from 10.0.0.5 port 5432 ssh2

Step 1: Count failed attempts
Search /var/log/auth.log for today's failed password attempts for user dev and count the lines.

sudo cat /var/log/auth.log | grep "Failed password for dev" | wc -l

Step 2: Update SSH configuration
Open the config file. Find the MaxAuthTries directive, uncomment it (remove #), and set the value higher than the count found in Step 1 (e.g., if count was 8, set to 10).

sudo nano /etc/ssh/sshd_config

Change: MaxAuthTries 10

Step 3: Validate syntax and restart
Check the configuration for syntax errors. If valid, restart the service to apply changes.

sudo sshd -t
sudo systemctl restart ssh