From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:58646) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XgVG9-0004mm-Np for qemu-devel@nongnu.org; Tue, 21 Oct 2014 04:57:47 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1XgVG3-0000SB-I2 for qemu-devel@nongnu.org; Tue, 21 Oct 2014 04:57:41 -0400 Received: from mx1.redhat.com ([209.132.183.28]:2498) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XgVG3-0000Ru-AM for qemu-devel@nongnu.org; Tue, 21 Oct 2014 04:57:35 -0400 Message-ID: <1413881843.14632.6.camel@nilsson.home.kraxel.org> From: Gerd Hoffmann Date: Tue, 21 Oct 2014 10:57:23 +0200 In-Reply-To: <5445F7D1.5060903@huawei.com> References: <1413375585-20301-1-git-send-email-kraxel@redhat.com> <1413375585-20301-7-git-send-email-kraxel@redhat.com> <20141015123110.GA3741@redhat.com> <1413382769.4213.5.camel@nilsson.home.kraxel.org> <20141015143915.GE3741@redhat.com> <1413456389.18160.1.camel@nilsson.home.kraxel.org> <5440B85F.3060307@huawei.com> <1413788563.3509.7.camel@nilsson.home.kraxel.org> <5445F7D1.5060903@huawei.com> Content-Type: text/plain; charset="UTF-8" Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCH 6/6] vnc: track & limit connections List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Gonglei Cc: "Huangweidong (C)" , "Huangpeng (Peter)" , "qemu-devel@nongnu.org" , Anthony Liguori , "Dr. David Alan Gilbert" On Di, 2014-10-21 at 14:06 +0800, Gonglei wrote: > On 2014/10/20 15:02, Gerd Hoffmann wrote: > > > > > Hi, > > > >> If we set the max trying times, and then > >> There are some concepts: > >> - INTERVAL_TIME: a time window that user can connnet vnc server > >> - REJECT_TIME: the time of reject any connection > >> - MAX_TRY_TIMES: the times that user can connect vnc server in INTERVAL_TIME, > >> if attach the MAX_TRY_TIMES, the server will lock, any user can not connect again > >> before REJECT_TIME attached. The old connected client will not be influenced. > > > > i.e. effectively rate-limit login attempts. Makes sense to have an > > option for that, although I'm not sure it is worth the trouble doing > > something beyond a simple "one attempt per second allowed" (i.e. stop > > polling the listening socket for a second after each accept). > > > > Hi, > > "one attempt per second allowed" is just reduce the frequency for attack, Yes. Which is common practice, to slow down dictionary attacks. > but I don't think the effect is very well. It can limit the login attempts for > attack problem from a flood of attack to "one attempt per second" (not > the same magnitude with my approach for security). Problem with rejecting is any login attempts for REJECT_TIME is that you also lock out the good guys. cheers, Gerd