Re: An Analysis of the DHEat DoS Against SSH in Cloud Environments

[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]

 



On Wed, Jun 19, 2024 at 02:10:30PM +1000, Damien Miller wrote:
> On Tue, 18 Jun 2024, Joseph S. Testa II wrote:
> 
> > In the upcoming v9.8 release notes I see "the server will now block
> > client addresses that repeatedly fail authentication, repeatedly
> > connect without ever completing authentication or that crash the
> > server."  Has this new PerSourcePenalties config directive been tested
> > against the DHEat attack?
> 
> Not explicitly but those attacks would trigger the "grace-exceeded"
> path, so they should be detectable and penalisable.
> 
> -d

real world example (current snapshot of portable on linux v. dheater)

Jun 19 09:09:47 server sshd-session[157401]: Connection reset by 10.0.0.1 port 45110 [preauth]
Jun 19 09:09:47 server sshd-session[157403]: Connection reset by 10.0.0.1 port 45116 [preauth]
Jun 19 09:09:47 server sshd-session[157405]: Connection reset by 10.0.0.1 port 45120 [preauth]
Jun 19 09:09:47 server sshd-session[157407]: Connection reset by 10.0.0.1 port 45126 [preauth]
Jun 19 09:09:47 server sshd-session[157409]: Connection reset by 10.0.0.1 port 45134 [preauth]
Jun 19 09:09:47 server sshd-session[157411]: Connection reset by 10.0.0.1 port 45148 [preauth]
Jun 19 09:09:47 server sshd-session[157413]: ssh_dispatch_run_fatal: Connection from 10.0.0.1 port 45154: DH GEX group out of range [preauth]
Jun 19 09:09:47 server sshd-session[157415]: Connection reset by 10.0.0.1 port 45160 [preauth]
Jun 19 09:09:47 server sshd-session[157417]: Connection reset by 10.0.0.1 port 45162 [preauth]
Jun 19 09:09:47 server sshd-session[157419]: Connection reset by 10.0.0.1 port 45170 [preauth]
Jun 19 09:09:47 server sshd-session[157421]: Connection reset by 10.0.0.1 port 45182 [preauth]
Jun 19 09:09:47 server sshd-session[157423]: Connection reset by 10.0.0.1 port 45194 [preauth]
Jun 19 09:09:47 server sshd-session[157425]: Connection reset by 10.0.0.1 port 45206 [preauth]
Jun 19 09:09:47 server sshd-session[157427]: Connection reset by 10.0.0.1 port 45212 [preauth]
Jun 19 09:09:47 server sshd-session[157429]: Connection reset by 10.0.0.1 port 45228 [preauth]
Jun 19 09:09:47 server sshd[156798]: drop connection #1 from [10.0.0.1]:45232 on [10.0.0.2]:22 penalty: connections without attempting authentication
Jun 19 09:09:47 server sshd[156798]: drop connection #0 from [10.0.0.1]:45240 on [10.0.0.2]:22 penalty: connections without attempting authentication

...

host will continue to drop future connections (and repeat the last line
in syslog)


_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev@xxxxxxxxxxx
https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev



[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]

[Index of Archives]     [Linux ARM Kernel]     [Linux ARM]     [Linux Omap]     [Fedora ARM]     [IETF Annouce]     [Security]     [Bugtraq]     [Linux]     [Linux OMAP]     [Linux MIPS]     [ECOS]     [Asterisk Internet PBX]     [Linux API]

  Powered by Linux