Re: what about rate limiting?



Hello Reed,
I think that these features will not be implemented, cause you can use a firewall to do that.
The MaxStartups have a behavior of a stochastical connection dropper, you can use this option to reduce concurrent attemps and prevent a DoS in sshd. In this option, you specify 3 colon-separated values like "20:40:50", the first is the "start value", second is the connection drop rate and the third is the full limit of concurrent connections. In this case, the shhd will refuse attemps with a probability of 40% if there are more then 20 concurrent connections (unauthenticated); and if the number of concurrent unauthenticated connections reaches 50, the daemon will drop all connections. It's extremely recommended that you use this stochastical connection drop if your box is exposed in the net, because the default approach to MaxStartups is 10, and with this value, a DoS can be started from a single box to prevent sshd access in the box.
Hope this help you.. and I hope to learn more english lol
- Christian S. Perone



Relevant Pages

  • Re: what about rate limiting?
    ... I think that these features will not be implemented, cause you can use a firewall to do that. ... and I hope to learn more english lol ... - Christian S. Perone ...
    (SSH)
  • Re: Cisco PIX 515E vs. Fortinet Fortigate-300
    ... I m getting one Fortigate box soon. ... > Firewall Evaluation ... > Cisco 515E: Cisco is a good company that stands behind its products. ... > advanced intrusion-protection features, including DNSGuard, ...
    (comp.security.firewalls)
  • Re: Identity P/W and Security question
    ... > can't call it a firewall unless it can filter in both directions). ... Far too many antivirus programs operate strictly on known virus definition ... Once in a great while I *do* want the popup - sometimes sites put ... > tool are bloatware filled with features. ...
    (alt.computer.security)
  • Re: SonicWALL vs. NetGear vs. LinkSys (Pricing/Functionality)
    ... stateful packet inspection, and application proxies. ... Your basic cheap cable/dsl ... other features like VPN's, IDS, extended logging, etc. which many of the ... device with maybe a free or cheap desktop firewall would suffice. ...
    (comp.security.firewalls)
  • Re: [fw-wiz] OT: vendors please respond
    ... 1> Exactly what is this firewall supposed to be protecting? ... A separate IDS? ... 10> Do you need centralized management? ... 1> Features you MUST have. ...
    (Firewall-Wizards)