OpenSSH has introduced built-in protection against automated password guessing attacks, where bots attempt to guess user passwords by trying various common combinations. To block such attacks, a new parameter, PerSourcePenalties, has been added to the sshd_config configuration file, allowing the definition of a blocking threshold that triggers after a large number of failed connection attempts from a single IP address. This new protection mechanism will be included in the next release of OpenSSH and will be enabled by default in OpenBSD 7.6.
When protection is enabled, the sshd process starts monitoring the completion status of child processes, identifying situations where authentication has failed or where the process was terminated abnormally due to a fault. A high frequency of authentication failures indicates password guessing attempts, while abnormal terminations may suggest attempts to exploit vulnerabilities in sshd.
The PerSourcePenalties parameter defines the minimum threshold of abnormal events, beyond which the IP address associated with suspicious activity will be blocked. Additionally, the PerSourceNetBlockSize parameter allows for defining a subnet mask to block the entire subnet to which the problematic IP belongs.
To disable blocking for specific subnets, the PerSourcePenaltyExemptList parameter has been proposed, which can be useful in situations that lead to false positives, such as when requests to the SSH server come from a large network where different users' requests originate from the same IP due to the use of address translation or proxies.
Source: opennet.ru
