← Back to context

Comment by petre

8 years ago

Another method is wasting attackers' time by sending out a character per second or so. It works so well for spam, that OpenBSD includes such a spamd honeypot.

12 comments

petre

Reply
SXX  8 years ago

Sending out character per second would mean that you'll keep connection open for long time and even if your server is behind CDN this would eventually let attacker exhaust your resources.

  • dredmorbius  8 years ago

    Think this through.

    If a large number of hosts treats some behaviour as deserving a slow-service attack, then clients exhibiting that behaviour are faced with a large set of slow-serving servers.

    Any given server can monitor how many slow-service attacks it is currently providing. Given that a criterion for an SSA is having already determined that the connection is not a friendly one, then monitoring useful vs. useless (e.g., SSA) connections, and being prepared to terminate (or better: simply abandon) the SSA connections as normal traffic ramps up, is a net benefit.

    Meantime, the hostile clients are faced by a pervasive wall of mud, slowing their access.

    • SXX  8 years ago

      If this monitoring and priorities already implemented within software that handle SSA that's okay, but using some custom untested trickery is simply dangerous.

      This is why I want to point out that simply serving content with delay and increasing number of active connections create additional attack vector that more dangerous than script kiddies scanner was in first place.

  • catdog  8 years ago

    An open connection with no communication going on does not take away a lot of resources, it's just some values in some table maintained by the TCP stack. If you implement that slow down service event based so it can handle a lot of concurrent connections it should not take away much resources either. In the end you can always limit the amount of connections you treat that way to a value your system can easily bear.

    • DamonHD  8 years ago

      This was exactly what I did for a while, and I was able to tie up tens or hundreds of SPAMmer connections without hurting myself, on quite a small mail server.

hossbeast  8 years ago

I would love to know how to configure this for ssh connection attempts

  • tyingq  8 years ago

    Ssh does support compression, but it seems to be only if the client requests it (ssh -C).

    You could, though, write a pam module to trickle data out very slowly. Maybe pam_python would be easier to experiment with.

    I use pam_shield to just null route ssh connections with X failed login attempts. There's no retaliation in that approach, but it does stop the brute forcing.

  • yorwba  8 years ago

    If you are being adventurous, I guess you can just let them log in for a special user that has the shell set to a program that sends single characters very slowly. It is probably quite insecure, though.

  • est  8 years ago

    I have something similar on my VPS, edit /etc/issues.net to this

        Permission denied. Please try again.