4.2.16: Add variable for SSH MaxAuthTries (#66)

Signed-off-by: Tom Henderson <[email protected]>

defaults/main.yml

@@ -858,6 +858,11 @@ amzn2023cis_sshd:
 #           in legacy environments;
 amzn2023cis_ssh_loglevel: INFO
 
+## Control 4.2.16 - Ensure SSH MaxAuthTries is set to 4 or less
+# This variable contains the maximum number of authentication attempts permitted
+# per connection. This number should be 10 or less.
+amzn2023cis_ssh_maxsauthtries: 4
+
 ## Control 4.2.18 - Ensure SSH MaxSessions is set to 10 or less
 # This variable contains the maximum number of open sessions permitted
 # from a given connection. This number should be 10 or less.

tasks/section_4/cis_4.2.x.yml

@@ -353,7 +353,7 @@
   ansible.builtin.lineinfile:
       path: "{{ item.path }}"
       regexp: '^(#)?MaxAuthTries \d'
-      line: 'MaxAuthTries 4'
+      line: 'MaxAuthTries {{ amzn2023cis_ssh_maxsauthtries }}'
       validate: sshd -t -f %s
   with_items:
       - "{{ sshd_d_conf_files.files }}"