3 ms·

I've read the commit message in the post, and read it again, but I did not understand how it would be configured. The penalty system seems complex but only 2 pa

I've read the commit message in the post, and read it again, but I did not understand how it would be configured. The penalty system seems complex but only 2 parameters are mentioned. From the documentation, one of these parameters is in fact a group of 8 parameters. I guess the separator is space, so one could write: PerSourcePenalties authfail:1m noauth:5m grace-exceeded:5m min:2m See https://man.openbsd.org/sshd_config.5#PerSourcePenalties https://man.openbsd.org/sshd_config.5#PerSourcePenalties Unfortunately, the default values are undocumented. So `PerSourcePenalties yes` (which will be the default value, according to the blog post) will apply some penalties. I did attempt to read the source code, but I'm reluctant to install a CVS client, two decades after dropping that versioning system.

mananaysiempre 2y ago
The OpenBSD project provides a CVSWeb interface[1] and a GitHub mirror[2]. The portable OpenSSH project[2] that most of the world gets their OpenSSH from uses a Git repo[4] that also has a Web interface (at the same address) and a GitHub mirror[5]. Per the code there[6], the default configuration seems to be PerSourcePenalties crash:90 authfail:5 noauth:1 grace-exceeded:20 max:600 min:15 max-sources:65536 overflow:permissive [1] https://cvsweb.openbsd.org/ https://cvsweb.openbsd.org/ [2] https://github.com/openbsd/src https://github.com/openbsd/src [3] https://www.openssh.com/portable.html https://www.openssh.com/portable.html [4] https://anongit.mindrot.org/openssh.git https://anongit.mindrot.org/openssh.git [5] https://github.com/openssh/openssh-portable https://github.com/openssh/openssh-portable [6] https://anongit.mindrot.org/openssh.git/tree/servconf.c?id=0e0c69761a4c33ccd4a256560f522784a753d1a8#n443 https://anongit.mindrot.org/openssh.git/tree/servconf.c?id=0...
frankjr 2y ago
https://github.com/openssh/openssh-portable/commit/81c1099d22b81ebfd20a334ce986c4f753b0db29#diff-06a27ce3ec94735e1b3de76e872c9a5a3643d87eb63f4b9dd688d27095abbf2aR415-R432 https://github.com/openssh/openssh-portable/commit/81c1099d2...

mananaysiempre 2y ago

The OpenBSD project provides a CVSWeb interface[1] and a GitHub mirror[2]. The portable OpenSSH project[2] that most of the world gets their OpenSSH from uses a Git repo[4] that also has a Web interface (at the same address) and a GitHub mirror[5]. Per the code there[6], the default configuration seems to be PerSourcePenalties crash:90 authfail:5 noauth:1 grace-exceeded:20 max:600 min:15 max-sources:65536 overflow:permissive [1] https://cvsweb.openbsd.org/ https://cvsweb.openbsd.org/ [2] https://github.com/openbsd/src https://github.com/openbsd/src [3] https://www.openssh.com/portable.html https://www.openssh.com/portable.html [4] https://anongit.mindrot.org/openssh.git https://anongit.mindrot.org/openssh.git [5] https://github.com/openssh/openssh-portable https://github.com/openssh/openssh-portable [6] https://anongit.mindrot.org/openssh.git/tree/servconf.c?id=0e0c69761a4c33ccd4a256560f522784a753d1a8#n443 https://anongit.mindrot.org/openssh.git/tree/servconf.c?id=0...

frankjr 2y ago

https://github.com/openssh/openssh-portable/commit/81c1099d22b81ebfd20a334ce986c4f753b0db29#diff-06a27ce3ec94735e1b3de76e872c9a5a3643d87eb63f4b9dd688d27095abbf2aR415-R432 https://github.com/openssh/openssh-portable/commit/81c1099d2...