OpenSSH introduces options to penalize undesirable behavior (undeadly.org)

Article summary

OpenSSH has introduced two new options, PerSourcePenalties and PerSourcePenaltyExemptList, to penalize undesirable client behavior, such as repeated authentication attempts. These options allow sshd to monitor the exit status of its child pre-auth session processes and record penalties against client addresses that exhibit problematic behavior. The penalties can be configured to refuse connections from client addresses that exceed a certain threshold. This new facility is designed to make it more difficult for attackers to find accounts with weak passwords or exploit bugs in sshd.

Main themes

• OpenSSH security features
• Penalizing undesirable behavior
• Authentication security
• SSH configuration
• Network security

What commenters say

• The new OpenSSH feature duplicates functionality of existing tools like fail2ban, but its implementation within sshd itself may provide a more secure and efficient solution.
• Removing password authentication from OpenSSH would reduce code complexity and attack surface, but could also add complexity for users who rely on password authentication for initial setup.
• The OpenBSD approach to security prioritizes simplicity and removing unnecessary code, but some argue that OpenSSH is too complex and configurable.
• Using SSH keys is a more secure and convenient alternative to password authentication, and should be the preferred method for accessing SSH connections.
• The new feature may cause issues for legitimate traffic if not properly configured, particularly for users behind large NAT blocks or proxies.
• Enforcing secure configurations, such as disabling password authentication, can be an effective way to improve security, but may not be practical for all use cases.