質問: デフォルトのログイン試行レート制限は何ですか? opensshを使用した標準のlinuxインストールでは、パスワード認証を使用したsshログイン試行のデフォルトのレート制限は何ですか?攻撃者は1時間にいくつのパスワードを推測できますか?
回答: man sshd_config: maxstartups specifies the maximum number of concurrent unauthenticated con‐ nections to the ssh daemon. additional connections will be dropped until authentication succeeds or the logingracetime expires for a connection. the default is 10:30:100. alternatively, random early drop can be enabled by specifying the three colon separated values “start:rate:full” (e.g. "10:30:60"). sshd(8) will refuse connection attempts with a probability of “rate/100” (30%) if there are currently “start” (10) unauthenti‐ cated connections. the probability increases linearly and all connection attempts are refused if the number of unauthenticated connections reaches “full” (60).