I never knew about this, is this documented somewhere?
On Wed, 23 Aug 2006, [EMAIL PROTECTED] wrote:
Hello Reed, I think that these features will not be implemented, cause you can use a firewall to do that. The MaxStartups have a behavior of a stochastical connection dropper, you can use this option to reduce concurrent attemps and prevent a DoS in sshd. In this option, you specify 3 colon-separated values like "20:40:50", the first is the "start value", second is the connection drop rate and the third is the full limit of concurrent connections. In this case, the shhd will refuse attemps with a probability of 40% if there are more then 20 concurrent connections (unauthenticated); and if the number of concurrent unauthenticated connections reaches 50, the daemon will drop all connections. It's extremely recommended that you use this stochastical connection drop if your box is exposed in the net, because the default approach to MaxStartups is 10, and with this value, a DoS can be started from a single box to prevent sshd access in the box. Hope this help you.. and I hope to learn more english lol - Christian S. Perone
