Some thoughts on OpenSSH 9.8's PerSourcePenalties feature

OpenSSH 9.8 introduces a new security feature called PerSourcePenalties, designed to mitigate certain types of attacks by blocking client addresses that repeatedly fail authentication or crash the server. This feature allows for more targeted blocking of malicious SSH sources, as opposed to the broader approach taken by perimeter firewalls, which can only block based on total connection volume. The PerSourcePenalties setting is expected to be included in the next OpenBSD release and subsequently in Fedora. While this feature is beneficial for enhancing security, it may pose challenges for systems that rely on health checks that do not complete authentication, as these could be mistakenly penalized. However, the default penalty duration is only one second, which should minimize disruptions for most health checks. Users are advised to monitor practical experiences with this feature before making adjustments to penalty durations, as the documentation does not clearly outline how penalty times accumulate. Overall, the rollout of OpenSSH 9.8 and its PerSourcePenalties feature is anticipated to provide improved security against SSH attacks while requiring careful consideration of its implications for system health checks.

- OpenSSH 9.8 introduces PerSourcePenalties to block malicious SSH sources.

- The feature allows for targeted blocking rather than broad connection volume-based blocking.

- Default penalty duration is one second, minimizing impact on health checks.

- Users are encouraged to observe practical experiences before adjusting penalty settings.

- The feature will be available in the next OpenBSD release and later in Fedora.