rate limiting sshd connections ?

[Mark Johnston]

Mike Tancsa <mike at sentex.net> wrote:
> Does anyone know of a way to rate limit ssh connections from an IP address?

I haven't used it myself, but ipfw (not sure whether it's ipfw2-only) has a 
limit directive:

     limit {src-addr | src-port | dst-addr | dst-port} N
             The firewall will only allow N connections with the same set of
             parameters as specified in the rule.  One or more of source and
             destination addresses and ports can be specified.

If you're getting lots of connects in parallel, that should improve things.  
Here's another thought, using dummynet:

ipfw pipe 1 config bw 1Kbit mask src-ip 0xffffffff
ipfw add 10 pipe 1 tcp from any to me 22 setup

1 kbit is 128 bytes/sec, which is roughly 2-3 average SYN packets per second.  
More than enough for a regular host, but fairly limiting against a flood.  
You can also implement this at the border:

ipfw pipe 1 config bw 1Kbit mask src-ip 0xffffffff dst-ip 0xffffffff
ipfw add 10 pipe 1 tcp from any to (LAN) 22 setup

(Dropping the dst-ip mask here would limit SYNs from any given IP to your 
whole LAN.)

These aren't tested, but they may give you some ideas.

Mark