An Analysis of the DHEat DoS Against SSH in Cloud Environments

[chris]

On Wed, Jun 19, 2024 at 02:10:30PM +1000, Damien Miller wrote:
> On Tue, 18 Jun 2024, Joseph S. Testa II wrote:
> 
> > In the upcoming v9.8 release notes I see "the server will now block
> > client addresses that repeatedly fail authentication, repeatedly
> > connect without ever completing authentication or that crash the
> > server."  Has this new PerSourcePenalties config directive been tested
> > against the DHEat attack?
> 
> Not explicitly but those attacks would trigger the "grace-exceeded"
> path, so they should be detectable and penalisable.
> 
> -d

real world example (current snapshot of portable on linux v. dheater)

Jun 19 09:09:47 server sshd-session[157401]: Connection reset by 10.0.0.1 port 45110 [preauth]
Jun 19 09:09:47 server sshd-session[157403]: Connection reset by 10.0.0.1 port 45116 [preauth]
Jun 19 09:09:47 server sshd-session[157405]: Connection reset by 10.0.0.1 port 45120 [preauth]
Jun 19 09:09:47 server sshd-session[157407]: Connection reset by 10.0.0.1 port 45126 [preauth]
Jun 19 09:09:47 server sshd-session[157409]: Connection reset by 10.0.0.1 port 45134 [preauth]
Jun 19 09:09:47 server sshd-session[157411]: Connection reset by 10.0.0.1 port 45148 [preauth]
Jun 19 09:09:47 server sshd-session[157413]: ssh_dispatch_run_fatal: Connection from 10.0.0.1 port 45154: DH GEX group out of range [preauth]
Jun 19 09:09:47 server sshd-session[157415]: Connection reset by 10.0.0.1 port 45160 [preauth]
Jun 19 09:09:47 server sshd-session[157417]: Connection reset by 10.0.0.1 port 45162 [preauth]
Jun 19 09:09:47 server sshd-session[157419]: Connection reset by 10.0.0.1 port 45170 [preauth]
Jun 19 09:09:47 server sshd-session[157421]: Connection reset by 10.0.0.1 port 45182 [preauth]
Jun 19 09:09:47 server sshd-session[157423]: Connection reset by 10.0.0.1 port 45194 [preauth]
Jun 19 09:09:47 server sshd-session[157425]: Connection reset by 10.0.0.1 port 45206 [preauth]
Jun 19 09:09:47 server sshd-session[157427]: Connection reset by 10.0.0.1 port 45212 [preauth]
Jun 19 09:09:47 server sshd-session[157429]: Connection reset by 10.0.0.1 port 45228 [preauth]
Jun 19 09:09:47 server sshd[156798]: drop connection #1 from [10.0.0.1]:45232 on [10.0.0.2]:22 penalty: connections without attempting authentication
Jun 19 09:09:47 server sshd[156798]: drop connection #0 from [10.0.0.1]:45240 on [10.0.0.2]:22 penalty: connections without attempting authentication

...

host will continue to drop future connections (and repeat the last line
in syslog)