Re: [Proftpd-user] Limiting number of TCP connections per host

Hi Matus,
I already have those setup, but they do not account for 3-way handshakes,
those directives count user sessions apparently. You could have them
limited at 50 for example but still be able to make hundreds of tcp 3-way
handshakes, firing up as many proftpd instances.



Best regards,

*Cosmin Neagu*




*Azets*

United Business Center 3,

Timisoara

www.azets.ro


On Mon, Jul 4, 2022 at 3:14 PM Matus UHLAR - fantomas <[email protected]>
wrote:

> On 04.07.22 14:31, Cosmin Neagu via Proftp-user wrote:
> >I noticed that for each tcp new session, a new proftpd process gets
> spanned
> >- just 3-way handshake, no other FTP commands being sent.
> >I'm searching for a way (other than through iptables) to control the
> number
> >of allowed TCP sessions per host, since I'm afraid this can easily be used
> >as a DOS attack on my proftpd servers.
> >Using MaxInstances/MaxClients does not seem to work, since those only look
> >at users/instances, after the user logs in.
> >Just opening the 3-way handshake starts a new instance, but is not
> >accounted for in those limits.
>
> perhaps one of these is what you want/need:
>
> http://www.proftpd.org/docs/modules/mod_auth.html#MaxClientsPerClass
> http://www.proftpd.org/docs/modules/mod_auth.html#MaxClientsPerHost
> http://www.proftpd.org/docs/modules/mod_auth.html#MaxClientsPerUser
>
>
> --
> Matus UHLAR - fantomas, [email protected] ; http://www.fantomas.sk/
> Warning: I wish NOT to receive e-mail advertising to this address.
> Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
> The early bird may get the worm, but the second mouse gets the cheese.
>
>
> _______________________________________________
> ProFTPD Users List   <[email protected]>
> Unsubscribe problems?
> http://www.proftpd.org/list-unsub.html
>

_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html