From: djm Date: Thu, 6 Jun 2024 20:25:48 +0000 (+0000) Subject: enable PerSourcePenalties by default. X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=f6832f21f1087f52ff357992489c017b55a20c06;p=openbsd enable PerSourcePenalties by default. ok markus NB. if you run a sshd that accepts connections from behind large NAT blocks, proxies or anything else that aggregates many possible users behind few IP addresses, then this change may cause legitimate traffic to be denied. Please read the PerSourcePenalties, PerSourcePenaltyExemptList and PerSourceNetBlockSize options in sshd_config(5) for how to tune your sshd(8) for your specific circumstances. --- diff --git a/usr.bin/ssh/servconf.c b/usr.bin/ssh/servconf.c index 51855b8c46b..89909819cba 100644 --- a/usr.bin/ssh/servconf.c +++ b/usr.bin/ssh/servconf.c @@ -1,4 +1,4 @@ -/* $OpenBSD: servconf.c,v 1.408 2024/06/06 17:15:25 djm Exp $ */ +/* $OpenBSD: servconf.c,v 1.409 2024/06/06 20:25:48 djm Exp $ */ /* * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland * All rights reserved @@ -388,7 +388,7 @@ fill_default_server_options(ServerOptions *options) if (options->per_source_masklen_ipv6 == -1) options->per_source_masklen_ipv6 = 128; if (options->per_source_penalty.enabled == -1) - options->per_source_penalty.enabled = 0; + options->per_source_penalty.enabled = 1; if (options->per_source_penalty.max_sources == -1) options->per_source_penalty.max_sources = 65536; if (options->per_source_penalty.overflow_mode == -1)