openssh unix dev - Jun 2024 - An Analysis of the DHEat DoS Against SSH in Cloud Environments

On Tue, 18 Jun 2024, Joseph S. Testa II wrote:
> In the upcoming v9.8 release notes I see "the server will now block
> client addresses that repeatedly fail authentication, repeatedly
> connect without ever completing authentication or that crash the
> server."  Has this new PerSourcePenalties config directive been tested
> against the DHEat attack?
Not explicitly but those attacks would trigger the "grace-exceeded"
path, so they should be detectable and penalisable.

-d

On Wed, Jun 19, 2024 at 02:10:30PM +1000, Damien Miller
wrote:
> On Tue, 18 Jun 2024, Joseph S. Testa II wrote:
> 
> > In the upcoming v9.8 release notes I see "the server will now
block
> > client addresses that repeatedly fail authentication, repeatedly
> > connect without ever completing authentication or that crash the
> > server."  Has this new PerSourcePenalties config directive been
tested
> > against the DHEat attack?
> 
> Not explicitly but those attacks would trigger the
"grace-exceeded"
> path, so they should be detectable and penalisable.
> 
> -d
real world example (current snapshot of portable on linux v. dheater)

Jun 19 09:09:47 server sshd-session[157401]: Connection reset by 10.0.0.1 port
45110 [preauth]
Jun 19 09:09:47 server sshd-session[157403]: Connection reset by 10.0.0.1 port
45116 [preauth]
Jun 19 09:09:47 server sshd-session[157405]: Connection reset by 10.0.0.1 port
45120 [preauth]
Jun 19 09:09:47 server sshd-session[157407]: Connection reset by 10.0.0.1 port
45126 [preauth]
Jun 19 09:09:47 server sshd-session[157409]: Connection reset by 10.0.0.1 port
45134 [preauth]
Jun 19 09:09:47 server sshd-session[157411]: Connection reset by 10.0.0.1 port
45148 [preauth]
Jun 19 09:09:47 server sshd-session[157413]: ssh_dispatch_run_fatal: Connection
from 10.0.0.1 port 45154: DH GEX group out of range [preauth]
Jun 19 09:09:47 server sshd-session[157415]: Connection reset by 10.0.0.1 port
45160 [preauth]
Jun 19 09:09:47 server sshd-session[157417]: Connection reset by 10.0.0.1 port
45162 [preauth]
Jun 19 09:09:47 server sshd-session[157419]: Connection reset by 10.0.0.1 port
45170 [preauth]
Jun 19 09:09:47 server sshd-session[157421]: Connection reset by 10.0.0.1 port
45182 [preauth]
Jun 19 09:09:47 server sshd-session[157423]: Connection reset by 10.0.0.1 port
45194 [preauth]
Jun 19 09:09:47 server sshd-session[157425]: Connection reset by 10.0.0.1 port
45206 [preauth]
Jun 19 09:09:47 server sshd-session[157427]: Connection reset by 10.0.0.1 port
45212 [preauth]
Jun 19 09:09:47 server sshd-session[157429]: Connection reset by 10.0.0.1 port
45228 [preauth]
Jun 19 09:09:47 server sshd[156798]: drop connection #1 from [10.0.0.1]:45232 on
[10.0.0.2]:22 penalty: connections without attempting authentication
Jun 19 09:09:47 server sshd[156798]: drop connection #0 from [10.0.0.1]:45240 on
[10.0.0.2]:22 penalty: connections without attempting authentication

...

host will continue to drop future connections (and repeat the last line
in syslog)