diff options
| author | Darren Tucker <dtucker@cvs.openbsd.org> | 2013-02-06 00:20:43 +0000 |
|---|---|---|
| committer | Darren Tucker <dtucker@cvs.openbsd.org> | 2013-02-06 00:20:43 +0000 |
| commit | b345b20e91ef24efbac02753ab038f34d1760a1a (patch) | |
| tree | 808e1d1d23c8c57f16c04e85e2f4fef73f5e584f /usr.bin/ssh | |
| parent | a23e11b18941fb8632e50fa0772d2bccd849167b (diff) | |
Change default of MaxStartups to 10:30:100 to start doing random early
drop at 10 connections up to 100 connections. This will make it harder
to DoS as CPUs have come a long way since the original value was set
back in 2000. Prompted by nion at debian org, ok markus@
Diffstat (limited to 'usr.bin/ssh')
| -rw-r--r-- | usr.bin/ssh/servconf.c | 8 | ||||
| -rw-r--r-- | usr.bin/ssh/sshd_config | 4 | ||||
| -rw-r--r-- | usr.bin/ssh/sshd_config.5 | 6 |
3 files changed, 9 insertions, 9 deletions
diff --git a/usr.bin/ssh/servconf.c b/usr.bin/ssh/servconf.c index 4ecfc8d0b8d..ca55775cfdc 100644 --- a/usr.bin/ssh/servconf.c +++ b/usr.bin/ssh/servconf.c @@ -1,5 +1,5 @@ -/* $OpenBSD: servconf.c,v 1.233 2012/12/02 20:46:11 djm Exp $ */ +/* $OpenBSD: servconf.c,v 1.234 2013/02/06 00:20:42 dtucker Exp $ */ /* * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland * All rights reserved @@ -242,11 +242,11 @@ fill_default_server_options(ServerOptions *options) if (options->gateway_ports == -1) options->gateway_ports = 0; if (options->max_startups == -1) - options->max_startups = 10; + options->max_startups = 100; if (options->max_startups_rate == -1) - options->max_startups_rate = 100; /* 100% */ + options->max_startups_rate = 30; /* 30% */ if (options->max_startups_begin == -1) - options->max_startups_begin = options->max_startups; + options->max_startups_begin = 10; if (options->max_authtries == -1) options->max_authtries = DEFAULT_AUTH_FAIL_MAX; if (options->max_sessions == -1) diff --git a/usr.bin/ssh/sshd_config b/usr.bin/ssh/sshd_config index 80e1f6fb7b1..89a26490ac5 100644 --- a/usr.bin/ssh/sshd_config +++ b/usr.bin/ssh/sshd_config @@ -1,4 +1,4 @@ -# $OpenBSD: sshd_config,v 1.88 2012/10/30 21:29:55 djm Exp $ +# $OpenBSD: sshd_config,v 1.89 2013/02/06 00:20:42 dtucker Exp $ # This is the sshd server system-wide configuration file. See # sshd_config(5) for more information. @@ -96,7 +96,7 @@ UsePrivilegeSeparation sandbox # Default for new installations. #ClientAliveCountMax 3 #UseDNS yes #PidFile /var/run/sshd.pid -#MaxStartups 10 +#MaxStartups 10:30:100 #PermitTunnel no #ChrootDirectory none #VersionAddendum none diff --git a/usr.bin/ssh/sshd_config.5 b/usr.bin/ssh/sshd_config.5 index 2eefb682c47..17c07bc7b16 100644 --- a/usr.bin/ssh/sshd_config.5 +++ b/usr.bin/ssh/sshd_config.5 @@ -33,8 +33,8 @@ .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" -.\" $OpenBSD: sshd_config.5,v 1.155 2013/01/18 08:00:49 jmc Exp $ -.Dd $Mdocdate: January 18 2013 $ +.\" $OpenBSD: sshd_config.5,v 1.156 2013/02/06 00:20:42 dtucker Exp $ +.Dd $Mdocdate: February 6 2013 $ .Dt SSHD_CONFIG 5 .Os .Sh NAME @@ -821,7 +821,7 @@ SSH daemon. Additional connections will be dropped until authentication succeeds or the .Cm LoginGraceTime expires for a connection. -The default is 10. +The default is 10:30:100. .Pp Alternatively, random early drop can be enabled by specifying the three colon separated values |