From owner-freebsd-questions@FreeBSD.ORG  Tue Aug 10 03:35:40 2010
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: questions@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id C849910656E8
	for <questions@freebsd.org>; Tue, 10 Aug 2010 03:35:40 +0000 (UTC)
	(envelope-from matt@gsicomp.on.ca)
Received: from gsicomp.on.ca (gsicomp.on.ca [200.46.208.251])
	by mx1.freebsd.org (Postfix) with ESMTP id 92C968FC16
	for <questions@freebsd.org>; Tue, 10 Aug 2010 03:35:40 +0000 (UTC)
Received: from maia.hub.org (maia-5.hub.org [200.46.204.29])
	by gsicomp.on.ca (Postfix) with ESMTP id 8ED9BFD1DE6;
	Tue, 10 Aug 2010 03:35:39 +0000 (UTC)
Received: from gsicomp.on.ca ([200.46.208.251])
	by maia.hub.org (mx1.hub.org [200.46.204.29]) (amavisd-maia, port 10024)
	with ESMTP id 04097-08; Tue, 10 Aug 2010 03:35:39 +0000 (UTC)
Received: from hermes (CPE002129cfd480-CM001ac3584898.cpe.net.cable.rogers.com
	[99.236.129.198])
	by gsicomp.on.ca (Postfix) with SMTP id D607CFD14D7;
	Tue, 10 Aug 2010 03:35:38 +0000 (UTC)
Message-ID: <F751E518EF274C37AC37DAD1E67D8254@hermes>
From: "Matt Emmerton" <matt@gsicomp.on.ca>
To: "James Harrison" <oscartheduck@gmail.com>
References: <ED433058084C4B0FAE9C516075BF0440@hermes>
	<EDE343D4-0B69-4425-B987-302EF5A7FED0@gmail.com>
Date: Mon, 9 Aug 2010 23:35:39 -0400
MIME-Version: 1.0
Content-Type: text/plain; format=flowed; charset="iso-8859-1";
	reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.5931
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5931
Cc: questions@freebsd.org
Subject: Re: ssh under attack - sessions in accepted state hogging CPU
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 10 Aug 2010 03:35:40 -0000

> > I know there's not much I can do about the brute force attacks, but will 
> > upgrading openssh avoid these stuck connections?
>
> 1. switch over to using solely RSA keys

In the works; I have too many users to convert :(

> 2. switch to a non-standard port

This is not attractive, even though it would be effective.  I tried this 
once already and my support volume skyrocketed.

> 3. what version of openssh are you currently using?

Whatever ships with 8.0-REL, which appears to be:


Best

James=