From owner-freebsd-current Wed Jul 8 16:35:15 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id QAA16741 for freebsd-current-outgoing; Wed, 8 Jul 1998 16:35:15 -0700 (PDT) (envelope-from owner-freebsd-current@FreeBSD.ORG) Received: from mail1.its.rpi.edu (root@mail1.its.rpi.edu [128.113.100.7]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id QAA16709 for ; Wed, 8 Jul 1998 16:35:06 -0700 (PDT) (envelope-from drosih@rpi.edu) Received: from [128.113.24.47] (gilead.acs.rpi.edu [128.113.24.47]) by mail1.its.rpi.edu (8.8.8/8.8.6) with ESMTP id TAA20220 for ; Wed, 8 Jul 1998 19:34:57 -0400 Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" X-Sender: drosih@pop1.rpi.edu Message-Id: In-Reply-To: <199807082045.GAA12071@godzilla.zeta.org.au> Date: Wed, 8 Jul 1998 19:38:54 -0400 To: freebsd-current@FreeBSD.ORG From: Garance A Drosihn Subject: Re: Rate limit for system calls to prevent denial of service attacks? Sender: owner-freebsd-current@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG >>The following small program: >> >> main(){while(1) fork();} >> >> is a very effective denial of service attack against FreeBSD-2.2.6, >> despite reasonable defaults in login.conf. The problem is *not* the >> number of processes, but the system call rate. It's actually kind of >> amazing to follow this with vmstat, and see that the box is suddenly >> doing 395000 system calls per second :-) (this is a P-166). The subject of this thread asks about adding a rate-limit for system calls. I don't think that's a good idea, but I would like to see some kind of throttling of calls to fork() in particular. Every year we (RPI) have a systems-programming project which introduces students to the fork() subroutine, and every year someone gets their if-statements mixed up and unwittingly writes a "fork bomb" which will bring down our remote-access machines. Now those machines aren't freebsd (not yet, at least!), but the idea of some extra logic in fork seems like it could be worthwhile. --- Garance Alistair Drosehn = gad@eclipse.its.rpi.edu Senior Systems Programmer or drosih@rpi.edu Rensselaer Polytechnic Institute To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-current" in the body of the message