openssh unix dev - Jun 2024 - An Analysis of the DHEat DoS Against SSH in Cloud Environments

On Wed, Jun 19, 2024 at 02:10:30PM +1000, Damien Miller
wrote:
> On Tue, 18 Jun 2024, Joseph S. Testa II wrote:
> 
> > In the upcoming v9.8 release notes I see "the server will now
block
> > client addresses that repeatedly fail authentication, repeatedly
> > connect without ever completing authentication or that crash the
> > server."  Has this new PerSourcePenalties config directive been
tested
> > against the DHEat attack?
> 
> Not explicitly but those attacks would trigger the
"grace-exceeded"
> path, so they should be detectable and penalisable.
> 
> -d
real world example (current snapshot of portable on linux v. dheater)

Jun 19 09:09:47 server sshd-session[157401]: Connection reset by 10.0.0.1 port
45110 [preauth]
Jun 19 09:09:47 server sshd-session[157403]: Connection reset by 10.0.0.1 port
45116 [preauth]
Jun 19 09:09:47 server sshd-session[157405]: Connection reset by 10.0.0.1 port
45120 [preauth]
Jun 19 09:09:47 server sshd-session[157407]: Connection reset by 10.0.0.1 port
45126 [preauth]
Jun 19 09:09:47 server sshd-session[157409]: Connection reset by 10.0.0.1 port
45134 [preauth]
Jun 19 09:09:47 server sshd-session[157411]: Connection reset by 10.0.0.1 port
45148 [preauth]
Jun 19 09:09:47 server sshd-session[157413]: ssh_dispatch_run_fatal: Connection
from 10.0.0.1 port 45154: DH GEX group out of range [preauth]
Jun 19 09:09:47 server sshd-session[157415]: Connection reset by 10.0.0.1 port
45160 [preauth]
Jun 19 09:09:47 server sshd-session[157417]: Connection reset by 10.0.0.1 port
45162 [preauth]
Jun 19 09:09:47 server sshd-session[157419]: Connection reset by 10.0.0.1 port
45170 [preauth]
Jun 19 09:09:47 server sshd-session[157421]: Connection reset by 10.0.0.1 port
45182 [preauth]
Jun 19 09:09:47 server sshd-session[157423]: Connection reset by 10.0.0.1 port
45194 [preauth]
Jun 19 09:09:47 server sshd-session[157425]: Connection reset by 10.0.0.1 port
45206 [preauth]
Jun 19 09:09:47 server sshd-session[157427]: Connection reset by 10.0.0.1 port
45212 [preauth]
Jun 19 09:09:47 server sshd-session[157429]: Connection reset by 10.0.0.1 port
45228 [preauth]
Jun 19 09:09:47 server sshd[156798]: drop connection #1 from [10.0.0.1]:45232 on
[10.0.0.2]:22 penalty: connections without attempting authentication
Jun 19 09:09:47 server sshd[156798]: drop connection #0 from [10.0.0.1]:45240 on
[10.0.0.2]:22 penalty: connections without attempting authentication

...

host will continue to drop future connections (and repeat the last line
in syslog)

On Wed, 2024-06-19 at 09:19 -0400, chris wrote:
> real world example (current snapshot of portable on linux v. dheater)
Thanks for this.  However, much more extensive testing would be needed
to show it is a complete solution.  In my original research article, I
used CPU idle time as the main metric.  Also, I showed that very low-
latency network links could bypass the existing countermeasures.

I suppose in the next few days, I'll try reproducing my original steps
with the new version and see what happens.

  - Joe