Re: [Proftpd-user] Limiting number of TCP connections per host

Scoreboard is enabled.
I guess I have to limit that with iptables then.
Thanks.


Best regards,

*Cosmin Neagu*

Network Architect

Phone +40.744.625.033



*Azets*

United Business Center 3,

Timisoara

www.azets.ro


On Mon, Jul 4, 2022 at 5:09 PM Matus UHLAR - fantomas <[email protected]>
wrote:

> On 04.07.22 16:57, Cosmin Neagu via Proftp-user wrote:
> >I already have those setup, but they do not account for 3-way handshakes,
> >those directives count user sessions apparently. You could have them
> >limited at 50 for example but still be able to make hundreds of tcp 3-way
> >handshakes, firing up as many proftpd instances.
>
> do you have scoreboardfile enabled? It's needed to count sessions.
>
> Also, with these directives proftpd still needs to open session even it it
> rejects the client after.
>
> if you have and some clients still open too much connections to your
> server,
> I'm afraid you'll have to limit them using firewall.
>
> >> On 04.07.22 14:31, Cosmin Neagu via Proftp-user wrote:
> >> >I noticed that for each tcp new session, a new proftpd process gets
> >> >spanned
> >> >- just 3-way handshake, no other FTP commands being sent.
> >> >I'm searching for a way (other than through iptables) to control the
> >> >number
> >> >of allowed TCP sessions per host, since I'm afraid this can easily be
> used
> >> >as a DOS attack on my proftpd servers.
> >> >Using MaxInstances/MaxClients does not seem to work, since those only
> look
> >> >at users/instances, after the user logs in.
> >> >Just opening the 3-way handshake starts a new instance, but is not
> >> >accounted for in those limits.
>
> >On Mon, Jul 4, 2022 at 3:14 PM Matus UHLAR - fantomas <[email protected]>
> >wrote:
> >> perhaps one of these is what you want/need:
> >>
> >> http://www.proftpd.org/docs/modules/mod_auth.html#MaxClientsPerClass
> >> http://www.proftpd.org/docs/modules/mod_auth.html#MaxClientsPerHost
> >> http://www.proftpd.org/docs/modules/mod_auth.html#MaxClientsPerUser
>
> --
> Matus UHLAR - fantomas, [email protected] ; http://www.fantomas.sk/
> Warning: I wish NOT to receive e-mail advertising to this address.
> Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
> Depression is merely anger without enthusiasm.
>
>
> _______________________________________________
> ProFTPD Users List   <[email protected]>
> Unsubscribe problems?
> http://www.proftpd.org/list-unsub.html
>

_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html