DDoS attack is distributed denial of service. By opening a large amount of connections to your server, attacker can reach the maximum limit of parallel authentication requests of
ssh server (defined in
MaxStartups) and prevent valid authentication requests to fail. Additionally, an unauthenticated session from an attacker is dropped after the time defined as
sshd_config (default 120s).
Fortunately, this feature is implemented in a way that should limit DDoS attacks by using "random early drop" using three values: "start:rate:full". Default value is
10:30:100, which translates to:
sshd(8) will refuse connection attempts with a probability of “rate/100” (30%) if there are currently “start” (10) unauthenticated connections. The probability increases linearly and all connection attempts are refused if the number of unauthenticated connections reaches “full” (100).
(from manual page for
This means that attacker can't "kill" your system, but at some point, you would need to retry before you will get connected.