An Analysis of the DHEat DoS Against SSH in Cloud Environments

[Damien Miller]

On Tue, 18 Jun 2024, Joseph S. Testa II wrote:

> In the upcoming v9.8 release notes I see "the server will now block
> client addresses that repeatedly fail authentication, repeatedly
> connect without ever completing authentication or that crash the
> server."  Has this new PerSourcePenalties config directive been tested
> against the DHEat attack?

Not explicitly but those attacks would trigger the "grace-exceeded"
path, so they should be detectable and penalisable.

-d