On Wed, Jun 19, 2024 at 02:10:30PM +1000, Damien Miller wrote: > On Tue, 18 Jun 2024, Joseph S. Testa II wrote: > > > In the upcoming v9.8 release notes I see "the server will now block > > client addresses that repeatedly fail authentication, repeatedly > > connect without ever completing authentication or that crash the > > server." Has this new PerSourcePenalties config directive been tested > > against the DHEat attack? > > Not explicitly but those attacks would trigger the "grace-exceeded" > path, so they should be detectable and penalisable. > > -d real world example (current snapshot of portable on linux v. dheater) Jun 19 09:09:47 server sshd-session[157401]: Connection reset by 10.0.0.1 port 45110 [preauth] Jun 19 09:09:47 server sshd-session[157403]: Connection reset by 10.0.0.1 port 45116 [preauth] Jun 19 09:09:47 server sshd-session[157405]: Connection reset by 10.0.0.1 port 45120 [preauth] Jun 19 09:09:47 server sshd-session[157407]: Connection reset by 10.0.0.1 port 45126 [preauth] Jun 19 09:09:47 server sshd-session[157409]: Connection reset by 10.0.0.1 port 45134 [preauth] Jun 19 09:09:47 server sshd-session[157411]: Connection reset by 10.0.0.1 port 45148 [preauth] Jun 19 09:09:47 server sshd-session[157413]: ssh_dispatch_run_fatal: Connection from 10.0.0.1 port 45154: DH GEX group out of range [preauth] Jun 19 09:09:47 server sshd-session[157415]: Connection reset by 10.0.0.1 port 45160 [preauth] Jun 19 09:09:47 server sshd-session[157417]: Connection reset by 10.0.0.1 port 45162 [preauth] Jun 19 09:09:47 server sshd-session[157419]: Connection reset by 10.0.0.1 port 45170 [preauth] Jun 19 09:09:47 server sshd-session[157421]: Connection reset by 10.0.0.1 port 45182 [preauth] Jun 19 09:09:47 server sshd-session[157423]: Connection reset by 10.0.0.1 port 45194 [preauth] Jun 19 09:09:47 server sshd-session[157425]: Connection reset by 10.0.0.1 port 45206 [preauth] Jun 19 09:09:47 server sshd-session[157427]: Connection reset by 10.0.0.1 port 45212 [preauth] Jun 19 09:09:47 server sshd-session[157429]: Connection reset by 10.0.0.1 port 45228 [preauth] Jun 19 09:09:47 server sshd[156798]: drop connection #1 from [10.0.0.1]:45232 on [10.0.0.2]:22 penalty: connections without attempting authentication Jun 19 09:09:47 server sshd[156798]: drop connection #0 from [10.0.0.1]:45240 on [10.0.0.2]:22 penalty: connections without attempting authentication ... host will continue to drop future connections (and repeat the last line in syslog) _______________________________________________ openssh-unix-dev mailing list openssh-unix-dev@xxxxxxxxxxx https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
