change default value of MaxStartups - CVE-2010-5107 - #908707

openssh-5.9p1-change-max-startups.patch

@@ -0,0 +1,42 @@
+diff -up openssh-5.9p1/servconf.c.max-startups openssh-5.9p1/servconf.c
+--- openssh-5.9p1/servconf.c.max-startups	2013-02-08 15:59:09.785709477 +0100
++++ openssh-5.9p1/servconf.c	2013-02-08 15:59:09.792709448 +0100
+@@ -265,11 +265,11 @@ fill_default_server_options(ServerOption
+ 	if (options->gateway_ports == -1)
+ 		options->gateway_ports = 0;
+ 	if (options->max_startups == -1)
+-		options->max_startups = 10;
++		options->max_startups = 100;
+ 	if (options->max_startups_rate == -1)
+-		options->max_startups_rate = 100;		/* 100% */
++		options->max_startups_rate = 30;		/* 30% */
+ 	if (options->max_startups_begin == -1)
+-		options->max_startups_begin = options->max_startups;
++		options->max_startups_begin = 10;
+ 	if (options->max_authtries == -1)
+ 		options->max_authtries = DEFAULT_AUTH_FAIL_MAX;
+ 	if (options->max_sessions == -1)
+diff -up openssh-5.9p1/sshd_config.5.max-startups openssh-5.9p1/sshd_config.5
+--- openssh-5.9p1/sshd_config.5.max-startups	2013-02-08 15:59:09.786709473 +0100
++++ openssh-5.9p1/sshd_config.5	2013-02-08 15:59:09.793709444 +0100
+@@ -796,7 +796,7 @@ SSH daemon.
+ Additional connections will be dropped until authentication succeeds or the
+ .Cm LoginGraceTime
+ expires for a connection.
+-The default is 10.
++The default is 10:30:100.
+ .Pp
+ Alternatively, random early drop can be enabled by specifying
+ the three colon separated values
+diff -up openssh-5.9p1/sshd_config.max-startups openssh-5.9p1/sshd_config
+--- openssh-5.9p1/sshd_config.max-startups	2013-02-08 15:59:09.000000000 +0100
++++ openssh-5.9p1/sshd_config	2013-02-08 16:00:03.784485797 +0100
+@@ -120,7 +120,7 @@ X11Forwarding yes
+ #ShowPatchLevel no
+ #UseDNS yes
+ #PidFile /var/run/sshd.pid
+-#MaxStartups 10
++#MaxStartups 10:30:100
+ #PermitTunnel no
+ #ChrootDirectory none
+ 

openssh.spec

@@ -216,6 +216,8 @@ Patch901: openssh-5.9p1-kuserok.patch
 Patch902: openssh-5.9p1-man-moduli.patch
 #https://bugzilla.redhat.com/show_bug.cgi?id=861818
 Patch903: openssh-5.9p1-ipqos.patch
+# change default value of MaxStartups - CVE-2010-5107 - #908707
+Patch904: openssh-5.9p1-change-max-startups.patch
 
 #---
 #https://bugzilla.mindrot.org/show_bug.cgi?id=1604
@@ -464,6 +466,7 @@ popd
 %patch901 -p1 -b .kuserok
 %patch902 -p1 -b .man-moduli
 %patch903 -p1 -b .ipqos
+%patch904 -p1 -b .max-startups
 
 %if 0
 # Nothing here yet