- WLUG - wlug.mailman3.com

Re: [Wlug] sshd_config MaxStartups

by Randall Mason

Maybe it's from a time when servers had fewer resources. If your server would run out of memory with 20 concurrent attempted logins, you may want to have that set to 20, else you should end up with a bigger DOS than if you were just able to prevent ssh logins. The same would be true with bandwidth. If you were on dialup, for example, you may want to make sure that you aren't overwhelming your connection, such that if you can only support 20 concurrent real time logins, you wouldn't end up with a terrible degradation in service. Not that it's too popular to run services on your bandwidth capped 2G internet connection... Sitting at a login prompt on my ARM NAS gives me this: sshd: Virt: 11672 Res: 5280 Shared: 4584 So it seems that I'm wasting 5MB of my 256MB of memory on my NAS when somebody just hangs at the login prompt. I could fairly easily DOS my little NAS by just running `while [ 1 ]; do ssh <box> & done`, couldn't I? Are you really using more than 10 connections sitting at a login prompt? What are they being used for? Is the system powerful enough to handle many concurrent logins? I think that today you should probably have this set up with a combination of dynamic blacklists (BlockHosts or sshguard) and this option, if your server is truly needing more resources. That way all of the failed logins don't eat up your cap for too long. The nice thing about the percent number is that it gives you, as an administrator, at least some chance of logging in before the system is so overloaded that you could never get in and start killing things. It could be that because ssh is becoming more of a transport layer than just a remote tty, this option is less useful. At Github for example, most of the unauthenticated connections that github has should just be dropped quickly because nobody uses password authentication. Randall Mason clashthebunny(a)gmail.com On Wed, Feb 11, 2015 at 9:46 AM, Jamie Guinan <guinan(a)bluebutton.com> wrote: > > Hi Group! > > I'm seeking opinions about an sshd feature. > > I was doing some work on a remote system (I did not set it up) that > seemed to be refusing ssh and scp connections randomly. > > I looked into it, and finally stumbled across this from sshd_config(5), > > MaxStartups > Specifies the maximum number of concurrent unauthenticated > connections to the SSH daemon. > Additional connections will be dropped until authentication > succeeds or the LoginGraceTime > expires for a connection. The default is 10. > > Alternatively, random early drop can be enabled by specifying > the three colon separated val‐ > ues “start:rate:full” (e.g. "10:30:60"). sshd(8) will refuse > connection attempts with a > probability of “rate/100” (30%) if there are currently > “start” (10) unauthenticated connec‐ > tions. The probability increases linearly and all connection > attempts are refused if the > number of unauthenticated connections reaches “full” (60). > > Indeed, the server had this setting, > > MaxStartups 10:50:20 > > This just seems like a terrible option. You can DOS their server just > by making 20 connections and leaving them hanging. And it breaks any > automated scripts relying on ssh or scp (unless you wrap them in a > loop until they succeed, ugh). > > My guess is that the reasoning behind this feature that it will filter > out a number of automated attacks. That seems no better than > security-by-obscurity, and I know how some of you feel about that. :) > > Can you think of any sane reason to enable this feature, or for it to > even exist at all? > > Best regards, > -Jamie > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug > >

Feb. 11, 2015

sshd_config MaxStartups

by Jamie Guinan

Hi Group! I'm seeking opinions about an sshd feature. I was doing some work on a remote system (I did not set it up) that seemed to be refusing ssh and scp connections randomly. I looked into it, and finally stumbled across this from sshd_config(5), MaxStartups Specifies the maximum number of concurrent unauthenticated connections to the SSH daemon. Additional connections will be dropped until authentication succeeds or the LoginGraceTime expires for a connection. The default is 10. Alternatively, random early drop can be enabled by specifying the three colon separated val‐ ues “start:rate:full” (e.g. "10:30:60"). sshd(8) will refuse connection attempts with a probability of “rate/100” (30%) if there are currently “start” (10) unauthenticated connec‐ tions. The probability increases linearly and all connection attempts are refused if the number of unauthenticated connections reaches “full” (60). Indeed, the server had this setting, MaxStartups 10:50:20 This just seems like a terrible option. You can DOS their server just by making 20 connections and leaving them hanging. And it breaks any automated scripts relying on ssh or scp (unless you wrap them in a loop until they succeed, ugh). My guess is that the reasoning behind this feature that it will filter out a number of automated attacks. That seems no better than security-by-obscurity, and I know how some of you feel about that. :) Can you think of any sane reason to enable this feature, or for it to even exist at all? Best regards, -Jamie

Feb. 11, 2015

Re: [Wlug] linux networking question (reformatted for readability)

by Frank Sweetser

On 2/7/2015 5:14 PM, Brad wrote: > On Sat, Feb 07, 2015 at 04:40:36PM -0500, Frank Sweetser wrote: >> This is just a rough guess, but did you ever check on the state tables >> in your openbsd firewall? >> > I did not check the state tables in the OpenBSD firewall. I figured > since it had just been forcefully reboot the state tables were > coherent. It's not just a simple question of the firewall state table being internally consistent, it also has to be consistent with both the NAT gateway and what the clients are expecting. When one of your internal clients makes an outgoing connection, both the firewall and NAT tables have to have entries added to accommodate the return traffic - a translation rule in the NAT table, and an allow rule in the firewall. If either of those aren't correct, the return traffic won't make it back to the client. >> In your setup you have state distributed >> amongst your clients, your firewall, and you NAT gateway, and unless >> all three are in sync you can easily get the kind of possessed network >> behavior you describe. >> > To properly exorcize should i pour holy-water over the routers? I always > figured some king of black magic was involved in routing. Simple routing, not so much - it's just packet go in, packet go out. It's when you throw state tables in that things start to get fragile. When you have strings of disconnected state tables that require consistency like this, it's not uncommon that you end up having to always reboot them together. > Is a bridged-firewall not a good idea in practice because it adds > another layer between the internat and the intranet, and could get out > of sync? The bridged portion itself isn't inherently much worse than doing a traditional layer 3 visible firewall, so long as you have your rules set up correctly to account for things like passing ARP traffic. Your typical all-in-one box is a little less likely to display this kind of weirdness only because they're combined on a single box, so a reboot will clear both out simultaneously. I would seriously suggest you check out pfSense. It's a FreeBSD based distribution designed to operate as a SOHO class firewall, with all of the usual NAT, DHCP, and other expected goodies. I think it's a pretty safe bet that it'll be a better router and firewall than OSX... -- Frank Sweetser fs at wpi.edu | For every problem, there is a solution that Manager of Network Operations | is simple, elegant, and wrong. Worcester Polytechnic Institute | - HL Mencken

Feb. 8, 2015

Re: [Wlug] linux networking question (reformatted for readability)

by Brad

On Sat, Feb 07, 2015 at 04:40:36PM -0500, Frank Sweetser wrote: > This is just a rough guess, but did you ever check on the state tables > in your openbsd firewall? > I did not check the state tables in the OpenBSD firewall. I figured since it had just been forcefully reboot the state tables were coherent. > In your setup you have state distributed > amongst your clients, your firewall, and you NAT gateway, and unless > all three are in sync you can easily get the kind of possessed network > behavior you describe. > To properly exorcize should i pour holy-water over the routers? I always figured some king of black magic was involved in routing. Is a bridged-firewall not a good idea in practice because it adds another layer between the internat and the intranet, and could get out of sync? Thanks for the ideas, - brad > On February 7, 2015 3:20:15 PM EST, Brad <bkn(a)ithryn.net> wrote: > >(i appologize for the previous message that i completely unreadable.) > > > >Dear W-LUGgers, > > > >I had some strange network related behavior that left me baffled and i > >wanted > >to hear some theories from more experienced network admins. > > > >The network layout is the following. The network is pretty simple, > >external > >traffic passes through a bridged-firewall (OpenBSD, my choice) into an > >OS X > >server (not my choice) which handles NAT/DHCP/DNS et al., and all the > >office > >computers are dhcp clients to the OS X server. The trouble machines are > >linux > >(ubuntu) desktop clients. > > > >The scenario is the following. I was doing work on the bridged firewall > >(OpenBSD) and somehow caused it to kernel panic, oopsie! So the > >bridged-firewall went down thus no-one had internet access, Dou! i > >quickly > >bounced the machine. It came back on-line and clients were able to > >access the > >internet, huzzah! But, the strange behavior was in two linux machines > >within > >the network that were not able to access some external IPs. My linux > >desktop > >could not access 8.8.8.8, when pinging, i could see an arp who-has > >request > >originating from my machine, i could see the packet come into the OS X > >server. > >But the request always went unanswered. The same behavior happened to > >another > >linux desktop but with 192.48.178.134 (sgi.com) My desktop could ping > >sgi.com. > >So each linux desktop had *different* unreachable IPs. The rest of the > >internet > >was reachable. I tried clearing the arp-cache on the OS X server, then > >clearing > >the NAT state tables, then I rebooted the OS X server, none solved the > >problem. > >I finally renewed the dhcp lease on my linux desktop machine and that > >allowed > >the ping to complete. > > > >What would case this behavior? Could it be stale arp-cache on the linux > >machine? ( I *should* have tried to clear the arp-cache on the linux > >machine > >before i renewed the dhcp lease, but i didn’t think of that until after > >the > >fact.) The linux machine was sending out arp who-has requests so would > >a stale > >cache even matter? Why would no one answer the arp requests? I am not > >an expert > >network admin (its just a side job since the company is only 15 > >people). I > >don’t expect to get a resolution but i’m interested to hear any > >theories. > > > >Thanks and cheers, — brad > > > >PS. As a worcester transplant to boston, i am really jealous i don’t > >live > >closer to attend meetings. The topics of late sound outstanding. > > > >_______________________________________________ > >Wlug mailing list > >Wlug(a)mail.wlug.org > >http://mail.wlug.org/mailman/listinfo/wlug > > -- > Sent from my Android device with K-9 Mail. Please excuse my brevity.

Feb. 7, 2015

Re: [Wlug] linux networking question (reformatted for readability)

by Frank Sweetser

This is just a rough guess, but did you ever check on the state tables in your openbsd firewall? In your setup you have state distributed amongst your clients, your firewall, and you NAT gateway, and unless all three are in sync you can easily get the kind of possessed network behavior you describe. On February 7, 2015 3:20:15 PM EST, Brad <bkn(a)ithryn.net> wrote: >(i appologize for the previous message that i completely unreadable.) > >Dear W-LUGgers, > >I had some strange network related behavior that left me baffled and i >wanted >to hear some theories from more experienced network admins. > >The network layout is the following. The network is pretty simple, >external >traffic passes through a bridged-firewall (OpenBSD, my choice) into an >OS X >server (not my choice) which handles NAT/DHCP/DNS et al., and all the >office >computers are dhcp clients to the OS X server. The trouble machines are >linux >(ubuntu) desktop clients. > >The scenario is the following. I was doing work on the bridged firewall >(OpenBSD) and somehow caused it to kernel panic, oopsie! So the >bridged-firewall went down thus no-one had internet access, Dou! i >quickly >bounced the machine. It came back on-line and clients were able to >access the >internet, huzzah! But, the strange behavior was in two linux machines >within >the network that were not able to access some external IPs. My linux >desktop >could not access 8.8.8.8, when pinging, i could see an arp who-has >request >originating from my machine, i could see the packet come into the OS X >server. >But the request always went unanswered. The same behavior happened to >another >linux desktop but with 192.48.178.134 (sgi.com) My desktop could ping >sgi.com. >So each linux desktop had *different* unreachable IPs. The rest of the >internet >was reachable. I tried clearing the arp-cache on the OS X server, then >clearing >the NAT state tables, then I rebooted the OS X server, none solved the >problem. >I finally renewed the dhcp lease on my linux desktop machine and that >allowed >the ping to complete. > >What would case this behavior? Could it be stale arp-cache on the linux >machine? ( I *should* have tried to clear the arp-cache on the linux >machine >before i renewed the dhcp lease, but i didn’t think of that until after >the >fact.) The linux machine was sending out arp who-has requests so would >a stale >cache even matter? Why would no one answer the arp requests? I am not >an expert >network admin (its just a side job since the company is only 15 >people). I >don’t expect to get a resolution but i’m interested to hear any >theories. > >Thanks and cheers, — brad > >PS. As a worcester transplant to boston, i am really jealous i don’t >live >closer to attend meetings. The topics of late sound outstanding. > >_______________________________________________ >Wlug mailing list >Wlug(a)mail.wlug.org >http://mail.wlug.org/mailman/listinfo/wlug -- Sent from my Android device with K-9 Mail. Please excuse my brevity.

Feb. 7, 2015

linux networking question (reformatted for readability)

by Brad

(i appologize for the previous message that i completely unreadable.) Dear W-LUGgers, I had some strange network related behavior that left me baffled and i wanted to hear some theories from more experienced network admins. The network layout is the following. The network is pretty simple, external traffic passes through a bridged-firewall (OpenBSD, my choice) into an OS X server (not my choice) which handles NAT/DHCP/DNS et al., and all the office computers are dhcp clients to the OS X server. The trouble machines are linux (ubuntu) desktop clients. The scenario is the following. I was doing work on the bridged firewall (OpenBSD) and somehow caused it to kernel panic, oopsie! So the bridged-firewall went down thus no-one had internet access, Dou! i quickly bounced the machine. It came back on-line and clients were able to access the internet, huzzah! But, the strange behavior was in two linux machines within the network that were not able to access some external IPs. My linux desktop could not access 8.8.8.8, when pinging, i could see an arp who-has request originating from my machine, i could see the packet come into the OS X server. But the request always went unanswered. The same behavior happened to another linux desktop but with 192.48.178.134 (sgi.com) My desktop could ping sgi.com. So each linux desktop had *different* unreachable IPs. The rest of the internet was reachable. I tried clearing the arp-cache on the OS X server, then clearing the NAT state tables, then I rebooted the OS X server, none solved the problem. I finally renewed the dhcp lease on my linux desktop machine and that allowed the ping to complete. What would case this behavior? Could it be stale arp-cache on the linux machine? ( I *should* have tried to clear the arp-cache on the linux machine before i renewed the dhcp lease, but i didn’t think of that until after the fact.) The linux machine was sending out arp who-has requests so would a stale cache even matter? Why would no one answer the arp requests? I am not an expert network admin (its just a side job since the company is only 15 people). I don’t expect to get a resolution but i’m interested to hear any theories. Thanks and cheers, — brad PS. As a worcester transplant to boston, i am really jealous i don’t live closer to attend meetings. The topics of late sound outstanding.

Feb. 7, 2015

linux networking question.

by Brad

Feb. 7, 2015

Re: [Wlug] Reminder: Next WLUG Meeting will be Thursday February 12th 2015 @ 7pm Rm 331 (Mid-Century Room)

by Andy Stewart

On 02/05/2015 10:29 AM, Tim Keller wrote: > Hey Everybody, > > I'm glad to announce that our founder Andy Stewart will be doing a talk > on wireless mesh networking! > I expect this talk will be both entertaining and interesting. > > Afterwards we'll be retiring to Tech for pizza! > > Date: Thursday February 12th, 2015 7pm-9pm > Location: WPI Campus Center, Mid-Century Room 331 > > Later, > Tim. HI WLUG, Thanks, Tim, for sending that notice to the WLUG membership. Specifically, I will be discussing Broadband-Hamnet (trademark), which is a mesh network designed by amateur radio operators, but can be used by mere mortals :-) as well. One can reflash many versions of the the Linksys WRT54G with this software and create your own mesh network, as has been done in Austin, TX and I believe Seattle, WA. Also, the Ubiquiti hardware can be used. I will have slides and a few Linksys boxes to demonstrate the concept. Feel free to bring your laptop to connect to the demo network. One can connect via an ethernet cable (bring your own) or wirelessly. For more information: http://www.broadband-hamnet.org I look forward to seeing you at the meeting, and joining you afterwards for pizza. Andy -- Andy Stewart (KB1OIQ) Founder: Worcester Linux Users' Group Founder: Chelmsford Linux Meetup Group President: PART of Westford, MA (WB1GOF)

Feb. 6, 2015

Opening, C++/Linux SW Eng, Permanent; Johnston, RI

by Tim Longua

Our Client in Johnston, RI is looking for a Software Engineer to help in the design and development of an exciting next generation platform. This candidate will be working with cutting edge tools and technologies. Requirements Include: * 7 + years C/C++ experience developing commercial products * Experience developing distributed systems and applications on RedHat Linux or Embedded Linux is required * Multithreaded and object oriented design experience * Oracle, MySQL, or other database experience * TCP/IP, Socket Programming, Qt and Hadoop are all plusses If interested please send your resume to timL (at) connectedsp.com. Regards, Tim Longua Connected Systems Partners Connecting Top Talent with Top Companies Office: 978-455-5550 x206 Cell: 603-303-8978 timL(a)connectedsp.com<mailto:jspencer@connectedsp.com> www.connectedsp.com<www.connectedsp.com%20> GET CONNECTED! Unless otherwise explicitly instructed by sender, all information in this email is considered confidential and intended for the view and use of the recipient(s) only.

Feb. 5, 2015

Reminder: Next WLUG Meeting will be Thursday February 12th 2015 @ 7pm Rm 331 (Mid-Century Room)

by Tim Keller

Hey Everybody, I'm glad to announce that our founder Andy Stewart will be doing a talk on wireless mesh networking! I expect this talk will be both entertaining and interesting. Afterwards we'll be retiring to Tech for pizza! Date: Thursday February 12th, 2015 7pm-9pm Location: WPI Campus Center, Mid-Century Room 331 Later, Tim. -- I am leery of the allegiances of any politician who refers to their constituents as "consumers".

Feb. 5, 2015