ClearML/dropbear
1
0
Fork 0
mirror of https://github.com/clearml/dropbear synced 2025-01-31 10:57:01 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Introduce extra delay before closing unauthenticated sessions

Browse Source 
To make it harder for attackers, introduce a delay to keep an
unauthenticated session open a bit longer, thus blocking a connection
slot until after the delay.

Without this, while there is a limit on the amount of attempts an attacker
can make at the same time (MAX_UNAUTH_PER_IP), the time taken by dropbear to
handle one attempt is still short and thus for each of the allowed parallel
attempts many attempts can be chained one after the other. The attempt rate
is then:
    "MAX_UNAUTH_PER_IP / <process time of one attempt>".

With the delay, this rate becomes:
    "MAX_UNAUTH_PER_IP / UNAUTH_CLOSE_DELAY".
This commit is contained in:
Thomas De Schampheleire 2017-02-15 13:53:04 +01:00
parent 5d60e5f312
commit 49177312fb
2 changed files with 24 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
default_options.h
View File

@ -256,6 +256,9 @@ Homedir is prepended unless path begins with / */
/* -T server option overrides */ /* -T server option overrides */
#define MAX_AUTH_TRIES 10 #define MAX_AUTH_TRIES 10
/* Delay introduced before closing an unauthenticated session (seconds) */
#define UNAUTH_CLOSE_DELAY 30
/* The default file to store the daemon's process ID, for shutdown /* The default file to store the daemon's process ID, for shutdown
scripts etc. This can be overridden with the -P flag */ scripts etc. This can be overridden with the -P flag */
#define DROPBEAR_PIDFILE "/var/run/dropbear.pid" #define DROPBEAR_PIDFILE "/var/run/dropbear.pid"

21
svr-session.c
View File

@ -215,6 +215,7 @@ void svr_dropbear_exit(int exitcode, const char* format, va_list param) {
char fullmsg[300]; char fullmsg[300];
char fromaddr[60]; char fromaddr[60];
int i; int i;
int add_delay = 0;
#if DROPBEAR_PLUGIN #if DROPBEAR_PLUGIN
if ((ses.plugin_session != NULL)) { if ((ses.plugin_session != NULL)) {
@ -247,13 +248,33 @@ void svr_dropbear_exit(int exitcode, const char* format, va_list param) {
snprintf(fullmsg, sizeof(fullmsg), snprintf(fullmsg, sizeof(fullmsg),
"Exit before auth%s: (user '%s', %u fails): %s", "Exit before auth%s: (user '%s', %u fails): %s",
fromaddr, ses.authstate.pw_name, ses.authstate.failcount, exitmsg); fromaddr, ses.authstate.pw_name, ses.authstate.failcount, exitmsg);
add_delay = 1;
} else { } else {
/* before userauth */ /* before userauth */
snprintf(fullmsg, sizeof(fullmsg), "Exit before auth%s: %s", fromaddr, exitmsg); snprintf(fullmsg, sizeof(fullmsg), "Exit before auth%s: %s", fromaddr, exitmsg);
add_delay = 1;
} }
dropbear_log(LOG_INFO, "%s", fullmsg); dropbear_log(LOG_INFO, "%s", fullmsg);
/* To make it harder for attackers, introduce a delay to keep an
* unauthenticated session open a bit longer, thus blocking a connection
* slot until after the delay. Without this, while there is a limit on
* the amount of attempts an attacker can make at the same time
* (MAX_UNAUTH_PER_IP), the time taken by dropbear to handle one attempt
* is still short and thus for each of the allowed parallel attempts
* many attempts can be chained one after the other. The attempt rate is
* then:
* "MAX_UNAUTH_PER_IP / <process time of one attempt>".
* With the delay, this rate becomes:
* "MAX_UNAUTH_PER_IP / UNAUTH_CLOSE_DELAY".
*/
if ((add_delay != 0) && (UNAUTH_CLOSE_DELAY > 0)) {
TRACE(("svr_dropbear_exit: start delay of %d seconds", UNAUTH_CLOSE_DELAY));
sleep(UNAUTH_CLOSE_DELAY);
TRACE(("svr_dropbear_exit: end delay of %d seconds", UNAUTH_CLOSE_DELAY));
}
#if DROPBEAR_VFORK #if DROPBEAR_VFORK
/* For uclinux only the main server process should cleanup - we don't want /* For uclinux only the main server process should cleanup - we don't want
* forked children doing that */ * forked children doing that */