Re: what about rate limiting?

I never knew about this, is this documented somewhere?

On Wed, 23 Aug 2006, christian.perone@gmail.com wrote:

> Hello Reed,
> I think that these features will not be implemented, cause you can use a 
> firewall to do that.
> The MaxStartups have a behavior of a stochastical connection dropper, you can use this option to 
> reduce concurrent attemps and prevent a DoS in sshd. In this option, you specify 3 colon-separated 
> values like "20:40:50", the first is the "start value", second is the 
> connection drop rate and the third is the full limit of concurrent connections. In this case, the 
> shhd will refuse attemps with a probability of 40% if there are more then 20 concurrent connections 
> (unauthenticated); and if the number of concurrent unauthenticated connections reaches 50, the 
> daemon will drop all connections. It's extremely recommended that you use this stochastical 
> connection drop if your box is exposed in the net, because the default approach to MaxStartups is 
> 10, and with this value, a DoS can be started from a single box to prevent sshd access in the box.
> Hope this help you.. and I hope to learn more english lol
> - Christian S. Perone