From f6832f21f1087f52ff357992489c017b55a20c06 Mon Sep 17 00:00:00 2001 From: djm Date: Thu, 6 Jun 2024 20:25:48 +0000 Subject: [PATCH] enable PerSourcePenalties by default. ok markus NB. if you run a sshd that accepts connections from behind large NAT blocks, proxies or anything else that aggregates many possible users behind few IP addresses, then this change may cause legitimate traffic to be denied. Please read the PerSourcePenalties, PerSourcePenaltyExemptList and PerSourceNetBlockSize options in sshd_config(5) for how to tune your sshd(8) for your specific circumstances. --- usr.bin/ssh/servconf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/usr.bin/ssh/servconf.c b/usr.bin/ssh/servconf.c index 51855b8c46b..89909819cba 100644 --- a/usr.bin/ssh/servconf.c +++ b/usr.bin/ssh/servconf.c @@ -1,4 +1,4 @@ -/* $OpenBSD: servconf.c,v 1.408 2024/06/06 17:15:25 djm Exp $ */ +/* $OpenBSD: servconf.c,v 1.409 2024/06/06 20:25:48 djm Exp $ */ /* * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland * All rights reserved @@ -388,7 +388,7 @@ fill_default_server_options(ServerOptions *options) if (options->per_source_masklen_ipv6 == -1) options->per_source_masklen_ipv6 = 128; if (options->per_source_penalty.enabled == -1) - options->per_source_penalty.enabled = 0; + options->per_source_penalty.enabled = 1; if (options->per_source_penalty.max_sources == -1) options->per_source_penalty.max_sources = 65536; if (options->per_source_penalty.overflow_mode == -1) -- 2.20.1