Torjus Håkestad
a40110f2f5
- Use subtle.ConstantTimeCompare for static credential checks to prevent timing side-channel attacks - Cap failCounts (100k) and rememberedCreds (10k) maps with eviction to prevent memory exhaustion from botnet-scale scanning - Sweep expired credentials on each auth attempt - Add configurable max_connections (default 500) with semaphore to limit concurrent connections and prevent goroutine/fd exhaustion Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
19 lines
288 B
Plaintext
19 lines
288 B
Plaintext
log_level = "info"
|
|
|
|
[ssh]
|
|
listen_addr = ":2222"
|
|
host_key_path = "oubliette_host_key"
|
|
max_connections = 500
|
|
|
|
[auth]
|
|
accept_after = 10
|
|
credential_ttl = "24h"
|
|
|
|
[[auth.static_credentials]]
|
|
username = "root"
|
|
password = "toor"
|
|
|
|
[[auth.static_credentials]]
|
|
username = "admin"
|
|
password = "admin"
|