Suggestion: Limit maximum concurrent connections

[sbrl]

It might be cool to have a limit on the maximum number of concurrent connections in the tarpit. If the number is exceeded, then the oldest connections in the tarpit would be cut first.

I'm not sure if such a thing is really needed though - testing would be required.

Just an idea that came to mind!

[sophacles]

Hi - this is a pretty good thought! Just to be upfront and honest: I'm probably not going to do it. This was just a toy project for me - I was learning rust and the blog post I based this off of popped up as a perfect opportunity to make a fun thing while learning.

That being said - I am willing to discuss the pros and cons of such a change and merge PR that do it, etc!

A couple of observations running this on my home rig:

• it uses almost no resources other than FDs - I would suspect that this thing will hit ulimits long before having a noticeable impact, an interesting test would be to raise the ulimit and see how many connections are required before impacting the machine as a whole
• If the outgoing bandwidth is seriously constrained, this can be tweaked to up the time between sends, and change the data being sent from a formatted i64 to a single char.

It would be fun to see the usage on an internet server that is popular enough to get way more bot traffic than my home machine to see if the scaling holds, unfortunately I don't have access to one I'm willing or authorized to do this with.

A related thought this brings up: It could be amusing to have this work like a combo of fail2ban and inetd. endlessh would listen on port 22, and when a new connection comes in, it just passes it to sshd. After 3 failed logins from an IP, that IP is added to a list, future connections are tarpitted instead of passed along.

[sbrl]

My HTTP goaccess stats for the past 2 weeks:

Most of that is bots.

If it doesn't use all that many resources, then I'd certainly be up for running it - and it probably isn't worth adding the connection limit - though this would obviously require testing.

I would consider a merge request, but despite being quite experienced in other languages (JS, C♯, PHP, etc) - I'm having a tough time of learning Rust and I'm still a complete beginner.

Oooh, that would be interesting. I use SSHGuard + openssh on a different port myself, but that would be cool to try.