Re: [Proftpd-user] Limiting number of TCP connections per host

> I guess I have to limit that with iptables then.

ProFTPD is not a firewall; it *cannot* prevent clients from making TCP connections to it.  The best that ProFTPD can do is close unwanted connections quickly.

Which brings us to what defines an "unwanted connection".  The MaxInstances directive sets a limit on the number of forked processes -- but the TCP connection has to be made first.  Which means that yes, misbehaving/malicious clients can attempt to fill up all of your MaxInstances processes with TCP connections that are idle, doing nothing.

That's where there is the TimeoutLogin directive, which says that a client must authenticate within a certain amount of time, or it is disconnected.  And there are other modules can also attempt to mitigate such loitering connections, _e.g._:
  https://github.com/Castaglia/proftpd-mod_loiter

And then there are ways to restrict the source IP addresses/ranges from which your wanted connections originate; see this howto for more:
  http://www.proftpd.org/docs/howto/ConnectionACLs.html

ProFTPD provides multiple mechanisms for restricting who can connect, and what they can do -- but it cannot prevent TCP connections from occurring in the first place.

Hope this helps,
TJ


_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html