News for hackers. Stuff that matters.

A comment on Security through obscurity is underrated. Parent comment

Re:Security through obscurity is underrated by asimops on Monday October 24, 2022 @01:42PM (#33319836)
FYI, in modern ssh

  Compression delayed
is equal to

  Compression yes
which is the default already.

With regards to

  PerSourceMaxStartups
  PerSourceNetBlockSize
how do you configure it, in order to not make it a DOS vector?
[ Parent | on HN ]
Re:Security through obscurity is underrated by traceroute66 on Monday October 24, 2022 @03:10PM (#33321018)
> how do you configure it, in order to not make it a DOS vector?

You use it in conjunction with a third parameter that I forgot to mention, namely MaxStartups.

MaxStartups introduces a degree of randomness to the whole process, so you have MaxStartups X:Y:Z where:

     - X = Reference number of unauthenticated connections ("n")
     - Y = Percentage probability of dropping when n>X
     - Z = n=Z == all further unauthenticated connections dropped
Additional parameter that may be of interest is LoginGraceTime.

Fun fact, MaxStartups/PerSourceMaxStartups/PerSourceNetBlockSize were specifically introduced >6.1 in order to add firepower to combatting unauthenticated connection DoS attacks.

[ Parent | on HN ]