7

I'm noticing on my digital ocean server, that I'm getting a high volume of auth attempts. I don't have any passwords since I use sshe key auth, so I'm not worried about a break in. But can a determined attacker basically kill a system by sending auth requests?

Is there anything you can do to protect against ddos attacks like this?

Improve this question
2
  • 1
    Of course they can if they have enough bandwidth. Enough of any message will eventually override your infrastructure.
    – Neil Smithline
    Commented Sep 12, 2015 at 21:20
  • Do you have any other ports open on the machine?
    – Neil Smithline
    Commented Sep 12, 2015 at 23:09

1 Answer 1

Reset to default
8

DDoS attack is distributed denial of service. By opening a large amount of connections to your server, attacker can reach the maximum limit of parallel authentication requests of ssh server (defined in sshd_config variable MaxStartups) and prevent valid authentication requests to fail. Additionally, an unauthenticated session from an attacker is dropped after the time defined as LoginGraceTime in sshd_config (default 120s).

Fortunately, this feature is implemented in a way that should limit DDoS attacks by using "random early drop" using three values: "start:rate:full". Default value is 10:30:100, which translates to:

sshd(8) will refuse connection attempts with a probability of “rate/100” (30%) if there are currently “start” (10) unauthenticated connections. The probability increases linearly and all connection attempts are refused if the number of unauthenticated connections reaches “full” (100).

(from manual page for sshd_config(5))

This means that attacker can't "kill" your system, but at some point, you would need to retry before you will get connected.

Improve this answer
7
  • Gotcha, cool. Is there anything you can do to protect against ddos attacks like this other than dedicating a system to handle auth requests?
    – B T
    Commented Sep 12, 2015 at 21:25
  • 1
    There is plenty of possibilities. I was answering the same question today on stackoverflow.com/a/32542270/2196426
    – Jakuje
    Commented Sep 12, 2015 at 21:34
  • Bots could try public keys or other methods tho right? If a bot makes an attempt for a non-existent user, is that any less expensive for the machine than for an existing user?
    – B T
    Commented Sep 12, 2015 at 21:40
  • Yes. they could, but the entropy of a private key is much larger (8 char password is basically 64b compared to 1024b key -- the difference is more than 20 times) and probability of having such key is much smaller. If I am right, the whole checking stack runs even for non-existing users to avoid timing-atacks (Side-channel attack).
    – Jakuje
    Commented Sep 12, 2015 at 21:45
  • I would be surprised if running the whole stack for non-existent users would increase security in any way (and so would be surprised if that was done). I'm not worried about the key being discovered, I'm more curious about the system resources that would be used.
    – B T
    Commented Sep 12, 2015 at 22:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .