MaxStartups 10:30:60 is not a universal cloud-server upgrade over 10:30:99. In OpenSSH’s start:rate:full format, the last number sets the point at which all new unauthenticated connections are refused. A lower ceiling can limit unauthenticated connection pressure sooner, but it can also reject legitimate bursts sooner. Choose it based on expected connection concurrency and the effective configuration on your server—not a blanket rule that 60 “beats” 99.
What the three MaxStartups numbers mean
MaxStartups limits concurrent unauthenticated connections to the SSH daemon. Debian’s trixie manual describes the setting as start:rate:full: the first value is where probabilistic refusals begin, the second is the refusal probability at that point, and the third is the threshold at which all additional connection attempts are refused. The manual documents 10:30:100 as the default and 10:30:60 as an example; that example is not a universal recommendation. Debian trixie sshd_config(5)
As an Amazon Associate I earn from qualifying purchases.
OpenBSD’s manual describes the probability model in more detail: at the start threshold, refusal probability is the rate divided by 100; it then rises linearly until the full threshold, where all connection attempts are refused. OpenBSD 6.3 sshd_config(5)
Recommended Free Tools
What changes when the final value is 60 instead of 99?
With the first two values held constant, lowering the final value lowers the maximum number of concurrent unauthenticated connections the daemon will allow before refusing all new attempts. The refusal probability also reaches 100% at a lower connection count. This can constrain unauthenticated connection pressure sooner, but legitimate clients arriving in a burst may be refused sooner too.
#1 Best Overall
The manuals explain how the thresholds work; they do not establish that 10:30:60 performs better or is safer than 10:30:99 on cloud servers. Which value fits depends on the number of concurrent connections your legitimate clients need and the operational cost of rejecting valid connections.
MaxStartups is not MaxAuthTries
MaxStartups concerns concurrent connections that have not authenticated. MaxAuthTries limits authentication attempts permitted on an individual connection. Debian trixie and the OpenBSD reference both document a default of 6 for MaxAuthTries. Changing one setting does not change the other’s purpose or limit.
Check the running server before changing a value
A manual’s default does not prove what a particular cloud VM is using. Distribution, OpenSSH version, vendor changes, included configuration files, and host-specific overrides can affect the effective configuration.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →- Identify the setting and syntax. Confirm that the guide is discussing
MaxStartups, notMaxAuthTries, and interpret a three-part value asstart:rate:full. - Inspect the target host’s effective SSH configuration. Check the running host’s OpenSSH version and effective
sshdsettings, accounting for its included files and overrides. Do not assume a manual’s documented default is the server’s active value. - Preserve a working access path before editing. Keep an existing authenticated session or another tested recovery route while making a change; the manuals define the setting but do not prescribe a cloud-provider-specific rollout procedure.
- Validate against legitimate concurrency. Consider how many unauthenticated connections can arrive during normal use or a burst, then monitor for valid clients being refused after the change.
How to choose a threshold for a cloud server
Use a lower full threshold only when the earlier cap is appropriate for the server’s expected connection pattern. A setting that is too low can turn a burst of valid connection attempts into a reachability problem; a higher threshold allows more unauthenticated connections to remain concurrent before all new attempts are refused. Neither number can be declared best for cloud servers in general based on the documented semantics alone.
Quick Recap
Best Value
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Sturdy Cover: The trans-lux cover protects the log book from wear and tear, ensuring its longevity and maintaining the integrity of your recorded data.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts.
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11" - (Security-Pass-Down) Reorder SKU: LOG-100-7CW-PP(Security-Pass-Down)
Rank #4
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- This BookFactory log book is for security guards in any sector or business. You can report location, circumstances and report number.
- There are spaces to log the individual's names address, description and other identifying information. There are also spaces to note others involved, notes, and vehicle information if one was involved
- Wire-O, 100 Pages, Dimensions 3.5" x 5.25"
- Reorder SKU: LOG-100-M3CW-PP(Security-Report)
Rank #3
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
