On Di, 15.08.23 18:17, Dmitry Belyavskiy (dbelyavs@xxxxxxxxxx) wrote: > Dear Lennart, > > I'm sorry, I don't get. > > Quoting the https://www.freedesktop.org/software/systemd/man/systemd.socket.html#TriggerLimitIntervalSec= > > Configures a limit on how often this socket unit may be activated > within a specific time interval. The TriggerLimitIntervalSec= may be > used to configure the length of the time interval in the usual time > units "us", "ms", "s", "min", "h", … and defaults to 2s (See > systemd.time(7) for details on the various time units understood). The > TriggerLimitBurst= setting takes a positive integer value and > specifies the number of permitted activations per time interval, and > defaults to 200 for Accept=yes sockets (thus by default permitting 200 > activations per 2s), and 20 otherwise (20 activations per 2s). Set > either to 0 to disable any form of trigger rate limiting. If the limit > is hit, the socket unit is placed into a failure mode, and will not be > connectible anymore until restarted. Note that this limit is enforced > before the service activation is enqueued. > > But this behavior (the last sentence) exactly matches the DoS > described here: https://bugs.archlinux.org/task/62248 > Too many connections to an sshd server, configured using socket > activation can cause the socket to be disabled permanently > ("sshd.socket: Trigger limit hit, refusing further activation."). Yes, and if this is not what you want, then disable the ratelimit. That's what I am saying? Lennart -- Lennart Poettering, Berlin _______________________________________________ devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
