Re: [Proftpd-user] Limiting number of TCP connections per host

On 04.07.22 16:57, Cosmin Neagu via Proftp-user wrote:
>I already have those setup, but they do not account for 3-way handshakes,
>those directives count user sessions apparently. You could have them
>limited at 50 for example but still be able to make hundreds of tcp 3-way
>handshakes, firing up as many proftpd instances.

do you have scoreboardfile enabled? It's needed to count sessions.

Also, with these directives proftpd still needs to open session even it it 
rejects the client after.

if you have and some clients still open too much connections to your server, 
I'm afraid you'll have to limit them using firewall.

>> On 04.07.22 14:31, Cosmin Neagu via Proftp-user wrote:
>> >I noticed that for each tcp new session, a new proftpd process gets
>> >spanned
>> >- just 3-way handshake, no other FTP commands being sent.
>> >I'm searching for a way (other than through iptables) to control the
>> >number
>> >of allowed TCP sessions per host, since I'm afraid this can easily be used
>> >as a DOS attack on my proftpd servers.
>> >Using MaxInstances/MaxClients does not seem to work, since those only look
>> >at users/instances, after the user logs in.
>> >Just opening the 3-way handshake starts a new instance, but is not
>> >accounted for in those limits.

>On Mon, Jul 4, 2022 at 3:14 PM Matus UHLAR - fantomas <[email protected]>
>wrote:
>> perhaps one of these is what you want/need:
>>
>> http://www.proftpd.org/docs/modules/mod_auth.html#MaxClientsPerClass
>> http://www.proftpd.org/docs/modules/mod_auth.html#MaxClientsPerHost
>> http://www.proftpd.org/docs/modules/mod_auth.html#MaxClientsPerUser

-- 
Matus UHLAR - fantomas, [email protected] ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Depression is merely anger without enthusiasm.


_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html