Our ns1.grapheneos.org DNS server was targeted by a DoS attack yesterday. They didn't target the DNS service but rather... SSH. That's a new one.
Can see the traffic spike but it was hardly anything compared to the usual attacks. Still, SSH buckled.
nodeping.com/reports/status
Conversation
Replying to
If you're running recent OpenSSH sshd then check out PerSourceMaxStartups/PerSourceNetBlockSize for some anti-DoS measures
Also turning off the non-ECC key exchange algorithms removes the major CPU hogs. Something like:
KexAlgorithms=-diffie-hellman-*
should work
1
1
6
Replying to
It's the current stable release on Linux: OpenSSH_8.7p1, OpenSSL 1.1.1l 24 Aug 2021.
Configuration is at github.com/GrapheneOS/inf.
PerSourceMaxStartups would have helped a lot.
This was very small scale compared to the usual attacks on our web servers. It's weird to DoS SSH...
Replying to
PerSourceMaxStartups 1 and a dramatically higher value for MaxStartups like 4096 will at least make it a lot less trivial to DoS. I didn't realize it was so easy to cut off SSH access with the default configuration. Lesson learned since they seem to want to make a habit of this.
1
1
Show replies
They stopped pretty much immediately once it started causing rejected connections. The intention appears to have been testing how easily they could cause a disruption. Traffic burst only lasted about a minute.
I assume they're going to start bothering us regularly with this now.