Re:Security through obscurity is underrated
by traceroute66 on Monday October 24, 2022 @03:10PM
(#33321018)
> how do you configure it, in order to not make it a DOS vector?
You use it in conjunction with a third parameter that I forgot to mention, namely MaxStartups.
MaxStartups introduces a degree of randomness to the whole process, so you have MaxStartups X:Y:Z where:
- X = Reference number of unauthenticated connections ("n")
- Y = Percentage probability of dropping when n>X
- Z = n=Z == all further unauthenticated connections dropped
Additional parameter that may be of interest is LoginGraceTime.
Fun fact, MaxStartups/PerSourceMaxStartups/PerSourceNetBlockSize were specifically introduced >6.1 in order to add firepower to combatting unauthenticated connection DoS attacks.
You use it in conjunction with a third parameter that I forgot to mention, namely MaxStartups.
MaxStartups introduces a degree of randomness to the whole process, so you have MaxStartups X:Y:Z where:
Additional parameter that may be of interest is LoginGraceTime.Fun fact, MaxStartups/PerSourceMaxStartups/PerSourceNetBlockSize were specifically introduced >6.1 in order to add firepower to combatting unauthenticated connection DoS attacks.