From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:33775) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XgVTL-0002e6-6r for qemu-devel@nongnu.org; Tue, 21 Oct 2014 05:11:25 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1XgVTF-00054N-3I for qemu-devel@nongnu.org; Tue, 21 Oct 2014 05:11:19 -0400 Received: from szxga02-in.huawei.com ([119.145.14.65]:43000) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XgVTE-00053m-Ep for qemu-devel@nongnu.org; Tue, 21 Oct 2014 05:11:13 -0400 Message-ID: <544622E9.4020105@huawei.com> Date: Tue, 21 Oct 2014 17:10:01 +0800 From: Gonglei MIME-Version: 1.0 References: <1413375585-20301-1-git-send-email-kraxel@redhat.com> <1413375585-20301-7-git-send-email-kraxel@redhat.com> <20141015123110.GA3741@redhat.com> <1413382769.4213.5.camel@nilsson.home.kraxel.org> <20141015143915.GE3741@redhat.com> <1413456389.18160.1.camel@nilsson.home.kraxel.org> <5440B85F.3060307@huawei.com> <1413788563.3509.7.camel@nilsson.home.kraxel.org> <5445F7D1.5060903@huawei.com> <1413881843.14632.6.camel@nilsson.home.kraxel.org> In-Reply-To: <1413881843.14632.6.camel@nilsson.home.kraxel.org> Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCH 6/6] vnc: track & limit connections List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Gerd Hoffmann Cc: "Huangweidong (C)" , "Huangpeng (Peter)" , "qemu-devel@nongnu.org" , Anthony Liguori , "Dr. David Alan Gilbert" On 2014/10/21 16:57, Gerd Hoffmann wrote: > On Di, 2014-10-21 at 14:06 +0800, Gonglei wrote: >> On 2014/10/20 15:02, Gerd Hoffmann wrote: >> >>> >>> Hi, >>> >>>> If we set the max trying times, and then >>>> There are some concepts: >>>> - INTERVAL_TIME: a time window that user can connnet vnc server >>>> - REJECT_TIME: the time of reject any connection >>>> - MAX_TRY_TIMES: the times that user can connect vnc server in INTERVAL_TIME, >>>> if attach the MAX_TRY_TIMES, the server will lock, any user can not connect again >>>> before REJECT_TIME attached. The old connected client will not be influenced. >>> >>> i.e. effectively rate-limit login attempts. Makes sense to have an >>> option for that, although I'm not sure it is worth the trouble doing >>> something beyond a simple "one attempt per second allowed" (i.e. stop >>> polling the listening socket for a second after each accept). >>> >> >> Hi, >> >> "one attempt per second allowed" is just reduce the frequency for attack, > > Yes. Which is common practice, to slow down dictionary attacks. > >> but I don't think the effect is very well. It can limit the login attempts for >> attack problem from a flood of attack to "one attempt per second" (not >> the same magnitude with my approach for security). > > Problem with rejecting is any login attempts for REJECT_TIME is that you > also lock out the good guys. > Yes. But I think it is not a big problem, when the REJECT_TIME is over, the good guys can connect vnc successfully immediately. Or maybe we just lock those guys with "the same Source IP address" ? Best regards, -Gonglei