openstack
/
project-config
Code Issues Proposed changes

Tune sshd connections settings on test nodes 

Update the sshd_config on our test nodes to accomodate what appears to
be an increase in ssh scanner traffic. In particular LoginGraceTime
defaults to 120 seconds. We reduce that to 30 seconds to cycle
connections more quickly. Then we also increase the maximum number of
connection startups to 30 from the default of 10. We also reduce the
random fail rate from 30% to 10% between 31 and 100 connections.

I'm not entirely certain this will fix things, but based on what we've
seen from logs it may be what we need to make ssh to test nodes more
reliable.

Change-Id: Ifacf7d00de157ab2fb60cde990f0b49f03f71415
This commit is contained in:
Clark Boylan 2022-08-17 12:40:46 -07:00
parent e63b79785c
commit a6d4fae070
1 changed files with 13 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
nodepool/elements/infra-package-needs/post-install.d/89-sshd
View File

@ -31,3 +31,16 @@ sed -i -e'/PermitRootLogin/d' /etc/ssh/sshd_config \
# unnecessary password auth.
sed -i -e '/PasswordAuthentication/d' /etc/ssh/sshd_config \
&& echo "PasswordAuthentication no" >> /etc/ssh/sshd_config
# NOTE(clarkb): SSH scanners may be affecting Zuul ssh connectivity
# Default LoginGraceTime is 120. Reduce that to 30 to cycle connections more
# quickly.
sed -i -e '/LoginGraceTime/d' /etc/ssh/sshd_config \
&& echo "LoginGraceTime 30" >> /etc/ssh/sshd_config
# NOTE(clarkb): SSH scanners may be affecting Zuul ssh connectivity
# Default MaxStartups is 10:30:100 which means after 10 unauthenticated
# connections randomly drop 30% of connections with an increasing
# percentage until 100 connections is reached.
sed -i -e '/MaxStartups/d' /etc/ssh/sshd_config \
&& echo "MaxStartups 30:10:100" >> /etc/ssh/sshd_config