[nsp-sec] coordinated slow ssh crack attempts

[Florian Weimer]

Has anybody seen SSH server hangs preventing further logins
(LoginGraceTime not being enforced) as a result of this scanning
activity?

Looking at the OpenSSH sources, there's definitely a bug in the
implementation of the login timeout where
non-async-signal-handler-safe functions are called from a signal
handler.  (I've filed a Debian bug about this, but haven't received an
acknowledgement with the bug number yet, sorry.)

Possible symptoms include lots of zombie sshd processes, or sshd
processes hanging in the [net] state.

-- 
Florian Weimer                <fweimer at bfk.de>
BFK edv-consulting GmbH       http://www.bfk.de/
Kriegsstraße 100              tel: +49-721-96201-1
D-76133 Karlsruhe             fax: +49-721-96201-99