Re: [SSHd] Increasing wait time?

On May 6, 2008, Gilles wrote:
Is there a way to configure SSHd, so that the wait time between login
attempts increases after X failed tries?

I run sshd via inetd rather than as a stand-alone daemon. inetd provides
optional rate limiting functionality. For instance. putting

ssh stream tcp nowait/20/4/10 root /usr/sbin/sshd sshd -i

into /etc/inetd.conf set a limit of

* 20 overall ssh connections
* 4 connection attempts per minute
* at most 10 connections from a single IP

This works very well on a personal server, not sure how it scales up.

Cheers,

-- Norbert.
_______________________________________________
freebsd-questions@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscribe@xxxxxxxxxxx"

Relevant Pages

  • Re: How secure is inetd nowadays?
    ... There is no predefined limit to the number of instances, in this case, an attacker can open thousands of connections resulting in thousands of processes. ... And no, xinetd won't necessarily save you, although it may provide you with some configuration options you can set that will help. ... In certain ways, inetd is superior to xinetd, and preferable. ...
    (comp.os.linux.security)
  • Re: [SSHd] Increasing wait time?
    ... I run sshd via inetd rather than as a stand-alone daemon. ... at most 10 connections from a single IP ... Problem with today's modular software: ...
    (freebsd-questions)
  • Re: Changes to hosts.allow do no affect to inetd daemons some times
    ... updating /etc/hosts.allow and changing rules for ftpd won't take affect on ... >> inetd, there is no difference. ... > You are probably seeing the effect of persistent connections: ... > Note that long running services with the TCP wrappers functionality ...
    (freebsd-questions)
  • Re: 11 years of inetd default insecurity?
    ... we all blame Microsoft in insecure default configuration... ... With closer look we have good old inetd ... or allow an *infinite* number of connections to the port. ... If connection is closed by attacker before ...
    (Bugtraq)
  • Re: ssh dropping
    ... It runs separate from inetd. ... all ssh sessions are dropped. ... Even when inetd dies (I've seen it die, ... The fact that your connections remain when inetd dies (I assume you are ...
    (comp.security.ssh)