I'm noticing on my digital ocean server, that I'm getting a high volume of auth attempts. I don't have any passwords since I use sshe key auth, so I'm not worried about a break in. But can a determined attacker basically kill a system by sending auth requests?

Is there anything you can do to protect against ddos attacks like this?

  • 1
    Of course they can if they have enough bandwidth. Enough of any message will eventually override your infrastructure. – Neil Smithline Sep 12 '15 at 21:20
  • Do you have any other ports open on the machine? – Neil Smithline Sep 12 '15 at 23:09

DDoS attack is distributed denial of service. By opening a large amount of connections to your server, attacker can reach the maximum limit of parallel authentication requests of ssh server (defined in sshd_config variable MaxStartups) and prevent valid authentication requests to fail. Additionally, an unauthenticated session from an attacker is dropped after the time defined as LoginGraceTime in sshd_config (default 120s).

Fortunately, this feature is implemented in a way that should limit DDoS attacks by using "random early drop" using three values: "start:rate:full". Default value is 10:30:100, which translates to:

sshd(8) will refuse connection attempts with a probability of “rate/100” (30%) if there are currently “start” (10) unauthenticated connections. The probability increases linearly and all connection attempts are refused if the number of unauthenticated connections reaches “full” (100).

(from manual page for sshd_config(5))

This means that attacker can't "kill" your system, but at some point, you would need to retry before you will get connected.

  • Gotcha, cool. Is there anything you can do to protect against ddos attacks like this other than dedicating a system to handle auth requests? – B T Sep 12 '15 at 21:25
  • 1
    There is plenty of possibilities. I was answering the same question today on stackoverflow.com/a/32542270/2196426 – Jakuje Sep 12 '15 at 21:34
  • Bots could try public keys or other methods tho right? If a bot makes an attempt for a non-existent user, is that any less expensive for the machine than for an existing user? – B T Sep 12 '15 at 21:40
  • Yes. they could, but the entropy of a private key is much larger (8 char password is basically 64b compared to 1024b key -- the difference is more than 20 times) and probability of having such key is much smaller. If I am right, the whole checking stack runs even for non-existing users to avoid timing-atacks (Side-channel attack). – Jakuje Sep 12 '15 at 21:45
  • I would be surprised if running the whole stack for non-existent users would increase security in any way (and so would be surprised if that was done). I'm not worried about the key being discovered, I'm more curious about the system resources that would be used. – B T Sep 12 '15 at 22:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.