Re: rate limiting sshd connections ?

From: Patrick Proniewski (patpro_at_patpro.net)
Date: 05/11/04

  • Next message: Jason Stone: "Re: rate limiting sshd connections ?" 
    Date: Tue, 11 May 2004 22:37:06 +0200
To: Roger Marquis <marquis@roble.com>

    On 11 mai 2004, at 22:27, Roger Marquis wrote:

    > "slimmy baddog" wrote:
    >> I would strognly suggest that you dont use inetd for running services
    >> but
    >> running all your services as daemons wich is much faster for the
    >> system
    >> and safer.
    >
    > That used to be the recommendation, back when 50MHz CPUs were the
    > norm. With 1 GHz and faster CPUs the difference between sshd and
    > inetd starting a child sshd is in the millisecond range i.e, impossible
    > to distinguish by look and feel.

    in fact, I've seen an Apple XServe (two G4 1GHz processors) running
    MacOS
    X Server beeing DOSed by a remote Nagios probe testing it's sshd once
    per
    minute. On OSX, sshd runs from xinetd. The box used to need hard reboot
    once
    a day until the problem was identified and the nagios probe was
    disabled.

    my 2 cents.

    patpro 

    -- 
je cherche un poste d'admin-sys Mac/UNIX
(ou une jeune et jolie femme riche)
http://patpro.net/cv.php
_______________________________________________
freebsd-security@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"
  • Next message: Jason Stone: "Re: rate limiting sshd connections ?"

    Relevant Pages

    • Re: starting ssh from inetd
      ... which tends to enhance security. ... >security hole in a particular implementation of inetd, ... Are you saying sshd is insecure when running stand alone and that it ... running sshd through inetd does not simplify the programming ...
      (comp.security.ssh)
    • Re: ssh_exchange_identification uClinux problem
      ... I've learned alot doing "sshd -De" from scatch. ... up hopefully with inetd working with sshd. ... debug1: read PEM private key done: type RSA ... By default sshd does not let root login into a server. ...
      (comp.security.ssh)
    • Re: FreeBSD Security Advisory FreeBSD-SA-03:12.openssh
      ... > 99% of even the most heavily loaded servers have more than enough ... similar to sysutils/comconsole which reconfigures the shipping sshd to ... run under inetd so that others can benefit from your approach. ... Not to dismiss the idea of running sshd from inetd out of hand, ...
      (FreeBSD-Security)
    • Re: FreeBSD Security Advisory FreeBSD-SA-03:12.openssh
      ... >> All the restart target does is basically kill the pid using the pid file ... >> and then restart the daemon, so it is no more dangerous then the below. ... >every SysV sshd script is as sensible. ... None of these are problems when sshd is run from inetd. ...
      (FreeBSD-Security)
    • Re: FreeBSD Security Advisory FreeBSD-SA-03:12.openssh
      ... key generation time made running sshd out of inetd slow. ... > ssh daemon is a question many systems administrators are asking. ... you've got it backwards dude - inetd was developed way way back in the ... Most modern daemons (sshd, apache, bind, ...
      (FreeBSD-Security)