tyler.durden/openssh-portable
1
0
Fork 0
mirror of https://github.com/PowerShell/openssh-portable.git synced 2025-07-31 01:35:11 +02:00
Code Issues Packages Projects Releases Wiki Activity

- dtucker@cvs.openbsd.org 2013/02/06 00:20:42

Browse Source 
[servconf.c sshd_config sshd_config.5]
     Change default of MaxStartups to 10:30:100 to start doing random early
     drop at 10 connections up to 100 connections.  This will make it harder
     to DoS as CPUs have come a long way since the original value was set
     back in 2000.  Prompted by nion at debian org, ok markus@
This commit is contained in:
Damien Miller 2013-02-12 11:02:08 +11:00
parent 0cd2f8e5f8
commit 1f583df8c3
4 changed files with 15 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
ChangeLog
View File

@ -22,6 +22,12 @@
- djm@cvs.openbsd.org 2013/01/27 10:06:12 - djm@cvs.openbsd.org 2013/01/27 10:06:12
[krl.c] [krl.c]
actually use the xrealloc() return value; spotted by xi.wang AT gmail.com actually use the xrealloc() return value; spotted by xi.wang AT gmail.com
- dtucker@cvs.openbsd.org 2013/02/06 00:20:42
[servconf.c sshd_config sshd_config.5]
Change default of MaxStartups to 10:30:100 to start doing random early
drop at 10 connections up to 100 connections. This will make it harder
to DoS as CPUs have come a long way since the original value was set
back in 2000. Prompted by nion at debian org, ok markus@
20130211 20130211
- (djm) [configure.ac openbsd-compat/openssl-compat.h] Repair build on old - (djm) [configure.ac openbsd-compat/openssl-compat.h] Repair build on old

8
servconf.c
View File

@ -1,5 +1,5 @@
/* $OpenBSD: servconf.c,v 1.233 2012/12/02 20:46:11 djm Exp $ */ /* $OpenBSD: servconf.c,v 1.234 2013/02/06 00:20:42 dtucker Exp $ */
/* /*
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
* All rights reserved * All rights reserved
@ -256,11 +256,11 @@ fill_default_server_options(ServerOptions *options)
if (options->gateway_ports == -1) if (options->gateway_ports == -1)
options->gateway_ports = 0; options->gateway_ports = 0;
if (options->max_startups == -1) if (options->max_startups == -1)
options->max_startups = 10; options->max_startups = 100;
if (options->max_startups_rate == -1) if (options->max_startups_rate == -1)
options->max_startups_rate = 100; /* 100% */ options->max_startups_rate = 30; /* 30% */
if (options->max_startups_begin == -1) if (options->max_startups_begin == -1)
options->max_startups_begin = options->max_startups; options->max_startups_begin = 10;
if (options->max_authtries == -1) if (options->max_authtries == -1)
options->max_authtries = DEFAULT_AUTH_FAIL_MAX; options->max_authtries = DEFAULT_AUTH_FAIL_MAX;
if (options->max_sessions == -1) if (options->max_sessions == -1)

4
sshd_config
View File

@ -1,4 +1,4 @@
# $OpenBSD: sshd_config,v 1.88 2012/10/30 21:29:55 djm Exp $ # $OpenBSD: sshd_config,v 1.89 2013/02/06 00:20:42 dtucker Exp $
# This is the sshd server system-wide configuration file. See # This is the sshd server system-wide configuration file. See
# sshd_config(5) for more information. # sshd_config(5) for more information.
@ -109,7 +109,7 @@ UsePrivilegeSeparation sandbox # Default for new installations.
#ClientAliveCountMax 3 #ClientAliveCountMax 3
#UseDNS yes #UseDNS yes
#PidFile /var/run/sshd.pid #PidFile /var/run/sshd.pid
#MaxStartups 10 #MaxStartups 10:30:100
#PermitTunnel no #PermitTunnel no
#ChrootDirectory none #ChrootDirectory none
#VersionAddendum none #VersionAddendum none

6
sshd_config.5
View File

@ -33,8 +33,8 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\" .\"
.\" $OpenBSD: sshd_config.5,v 1.155 2013/01/18 08:00:49 jmc Exp $ .\" $OpenBSD: sshd_config.5,v 1.156 2013/02/06 00:20:42 dtucker Exp $
.Dd $Mdocdate: January 18 2013 $ .Dd $Mdocdate: February 6 2013 $
.Dt SSHD_CONFIG 5 .Dt SSHD_CONFIG 5
.Os .Os
.Sh NAME .Sh NAME
@ -820,7 +820,7 @@ SSH daemon.
Additional connections will be dropped until authentication succeeds or the Additional connections will be dropped until authentication succeeds or the
.Cm LoginGraceTime .Cm LoginGraceTime
expires for a connection. expires for a connection.
The default is 10. The default is 10:30:100.
.Pp .Pp
Alternatively, random early drop can be enabled by specifying Alternatively, random early drop can be enabled by specifying
the three colon separated values the three colon separated values