This commit introduces mechanism to limit the number of concurrent SSH
handshakes to prevent resource exhaustion (goroutines/memory) during a
SYN flood or connection flood attack.
1. **Global Limit:** A semaphore limits total concurrent handshakes to 20.
This applies backpressure to the `Accept` loop.
2. **Per-IP Limit:** Using `github.com/sethvargo/go-limiter`, we now
limit the rate of connection attempts per IP to 3 per second.
3. **Timeout:** The initial handshake timeout is reduced from 20s to 10s.
The global semaphore is acquired before the handshake and released
immediately after the handshake completes (or fails), ensuring that
long-lived sessions do not consume a handshake slot.
This commit introduces mechanism to limit the number of concurrent SSH
handshakes to prevent resource exhaustion (goroutines/memory) during a
SYN flood or connection flood attack.
1. **Global Limit:** A semaphore limits total concurrent handshakes to 20.
This applies backpressure to the `Accept` loop.
2. **Per-IP Limit:** Using `github.com/sethvargo/go-limiter`, we now
limit the rate of connection attempts per IP to 3 per second.
3. **Timeout:** The initial handshake timeout is reduced from 20s to 10s.
The global semaphore is acquired before the handshake and released
immediately after the handshake completes (or fails), ensuring that
long-lived sessions do not consume a handshake slot.
This commit introduces mechanism to limit the number of concurrent SSH
handshakes to prevent resource exhaustion (goroutines/memory) during a
SYN flood or connection flood attack.
1. **Global Limit:** A semaphore limits total concurrent handshakes to 20.
This applies backpressure to the `Accept` loop.
2. **Per-IP Limit:** Using `github.com/sethvargo/go-limiter`, we now
limit the rate of connection attempts per IP to 3 per second.
3. **Timeout:** The initial handshake timeout is reduced from 20s to 10s.
The global semaphore is acquired before the handshake and released
immediately after the handshake completes (or fails), ensuring that
long-lived sessions do not consume a handshake slot.
This commit introduces mechanism to limit the number of concurrent SSH
handshakes to prevent resource exhaustion (goroutines/memory) during a
SYN flood or connection flood attack.
1. **Global Limit:** A semaphore limits total concurrent handshakes to 20.
This applies backpressure to the `Accept` loop.
2. **Per-IP Limit:** Using `github.com/sethvargo/go-limiter`, we now
limit the rate of connection attempts per IP to 3 per second.
3. **Timeout:** The initial handshake timeout is reduced from 20s to 10s.
The global semaphore is acquired before the handshake and released
immediately after the handshake completes (or fails), ensuring that
long-lived sessions do not consume a handshake slot.
This commit introduces mechanism to limit the number of concurrent SSH
handshakes to prevent resource exhaustion (goroutines/memory) during a
SYN flood or connection flood attack.
1. **Global Limit:** A semaphore limits total concurrent handshakes to 20.
This applies backpressure to the `Accept` loop.
2. **Per-IP Limit:** A map limits concurrent handshakes to 3 per IP address.
Excess connections are rejected immediately.
3. **Timeout:** The initial handshake timeout is reduced from 20s to 10s.
The global semaphore is acquired before the handshake and released
immediately after the handshake completes (or fails), ensuring that
long-lived sessions do not consume a handshake slot.
This commit introduces a semaphore to limit the number of concurrent SSH
handshakes to 20. This prevents resource exhaustion (goroutines/memory)
during a SYN flood or connection flood attack where attackers stall
the handshake process.
Additionally, the initial handshake timeout is reduced from 20s to 10s
to clear stuck connections faster.
Backpressure is applied by blocking the Accept loop when the limit is reached,
allowing the kernel backlog to handle the excess load.
* Add SSH keys mount (mimicking default non-Docker behaviour).
* Increase manifest version to lowest 3.x supporting bind mounts.
* Change restart policy from `always` to `unless-stopped`.
* Set a container name.
* Fix port indentation to 2 spaces, as done elsewhere.
* move loading whitelist+ops from file to auth and save the loaded files fro reloading
* add /whitelist command with lots of open questions
* add test for /whitelist
* gofmt
* use the same auth (the tests don't seem to care, but htis is more right)
* mutex whitelistMode and remove some deferred TODOs
* s/whitelist/allowlist/ (user-facing); move helper functions outside the handler function
* check for ops in Auth.CheckPublicKey and move /allowlist handling to helper functions
* possibly fix the test timeout in HostNameCollision
* Revert "possibly fix the test timeout in HostNameCollision" (didn't work)
This reverts commit 664dbb0976.
* managed to reproduce the timeout after updating, hopefully it's the same one
* remove some unimportant TODOs; add a message when reverify kicks people; add a reverify test
* add client connection with key; add test for /allowlist import AGE
* hopefully make test less racy
* s/whitelist/allowlist/
* fix crash on specifying exactly one more -v flag than the max level
* use a key loader function to move file reading out of auth
* add loader to allowlist test
* minor message changes
* add --whitelist with a warning; update tests for messages
* apparently, we have another prefix
* check names directly on the User objects in TestHostNameCollision
* not allowlisted -> not allowed
* small message change
* update test
Fixes#402
When the user is not set as away, using the
`/back` or `/away` command should return error.
The previous behaviour was inconsistent,
`/away` sent a message and `/back` ignored it.
New behaviour is error for both cases.
Co-authored-by: Akshay <akshay.shekher@gmail.com>
* Move password authentication handling into sshd/auth (fixes#394).
Password authentication is now completely handeled in Auth. The normal
keyboard-interactive handler checks if passwords are supported and asks
for them, removing the need to override the callbacks.
Brute force throttling is removed; I'd like to base it on IP address
banning, which requires changes to the checks.
I'm not sure, but I think timing attacks against the password are fixed:
- The hashing of the real password happens only at startup.
- The hashing of a provided password is something an attacker can do
themselves; It doesn't leak anything about the real password.
- The hash comparison is constant-time.
* refactor checks, IP-ban incorrect passphrases, renames
- s/assword/assphrase/, typo fixes
- bans are checked separately from public keys
- an incorrect passphrase results in a one-minute IP ban
- whitelists no longer override bans (i.e. you can get banned if you're
whitelisted)
* (hopefully) final changes
* Fixes Env Vars to pass config to ssh-chat.
The env vars were beign parsed and set to the host
before the user was even added to the host and
hence ignored. This change moves the env var parsing
to after initializing the user.
TODO: tests, completeness+reliability
* cleaned up the test
* reduced test flakyness by adding wait instead of being optimistic
Co-authored-by: Akshay <akshay.shekher@gmail.com>
google-labs-jules[bot]
Andrey Petrov
Jag Talon
Benny Siegert
DejavuMoe
Steven Leibrock
pataquets
mik2k2
Andrey Petrov
Akshay ShekherandAkshay
Sy Tran