On Wed, Jun 1, 2016 at 9:51 PM, AG <openssh@xxxxxxxxxxxx> wrote: > Hello, > > I manage OpenSSH on a dozen or so servers that act as gateways for a large > amount of developers and system administrators. On these servers it is > common for there to be more than 1000 active X11 forwards active at peak > usage. Beyond ~1000 active X11 forwards, sshd will fail to bind additional > ports due to a hard coded range check in channels.c that limits the port > range that sshd will attempt to bind. Today this is set at 1000: I think your development environment is insane, but that's your problem, not mine. > channels.c:152:#define MAX_DISPLAYS 1000 > > I have made changes to OpenSSH portable that allow this setting to be > configured via an option in sshd_config named MaxDisplays. If not > explicitly set, it maintains the default value of 1000. This would seem a sane approach. I do hope you'll also document the change in the man page for sshd_config? I never have noticed documentation for the "sshd -r" option, though it still seems to exist. Options that are not documented..... are a long source of cofusion for many projects. > It seems to me that this setting should be configurable by the user similar > to how X11DisplayOffset is configurable. I've read the code carefully and > am currently using this patch in my production environment without any > issues. I don't see any reason this change would cause any issues for users > that do not need to explicitly set it. I also don't envision this being a > maintenance burden as it's a very simple feature. > > I'd appreciate this being considered for acceptance into OpenSSH. > > Also, I'm curious if this issue has ever come up before? Is it really that > strange of a case? >From decades in the field, I'd say It's pretty weird. I've not personally seen anything approaching that number of clients on a single server in..... well, not since I worked with Multics back in the 1980's. Dozens on a robust system, yes. One thousand? > I understand that you don't utilize GitHub for development, but for > convenience you can see the changes in a web browser: > > https://github.com/openssh/openssh-portable/pull/41 > > I've attached the patch to this message as well. > > Thanks, > Adam > _______________________________________________ openssh-unix-dev mailing list openssh-unix-dev@xxxxxxxxxxx https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
