Re: [OT] SSH throttle - security

[Daniel Eggert <eggert%macvaerk.dtu.dk@localhost>]

On Jan 26, 2009, at 1:41 PM, Donald Lee wrote:

> [sorry for the OT]
>
> I have an ssh annoyance - my logs are FULL of cracking attempts.   
> This is
> an externally visible server, so I can't simply shut off access.   
> They are
> trying lots of random accounts, and I'm not worried that they'll get  
> in,
> but it's a pain, both because it generates huge logfiles, and also
> because it burns non-trivial CPU.
>
> Does anyone know of an option/method to "throttle" incoming SSH  
> requests.
> I would be more than happy to limit said requests to one every N  
> seonds,
> where N is in the range of 5-10 (or more?)
>
> I don't see anything in the docs or on the web that will allow me to
> do this.  I'm not anxious to write proxy software to do this. :-<
>
> I figure this might be of general interest to anyone with an exposed
> server.
>
> Thanks,
>
> -dgl-

Have a look at MaxStartups. This also allows for "random early drop".  
You could set it to

MaxStartups 2:50:6

With this sshd will refuse connection attempts with a probability of  
50% if there are currently 2 unauthenticated connections. The  
probability increases linearly and all connection attempts are refused  
if the number of unauthenticated connections reaches 6.

/Daniel