      Can significantly increase bandwidth usage for interactive
      sessions: It sends data in packets of 1024 bytes, and pads 
      smaller messages up to this length, so a 1 byte write could 
      be expanded to 1024 bytes if it cannot be coalesced with 
      adjacent bytes.
      """
      -- https://code.google.com/p/spiped/source/browse/trunk/README
    

More secure, but more overhead. That said, I love spiped. I use it to secure a
few mysql replication streams and a couple other things. Works great.

I wonder if there is anything like spiped that provides something similar to
openvpn's tls-auth (HMAC auth) functionality, for protocols that already
provide encryption.

------
Udo
It would also be nice if SSHd had an option to block an IP address after a
certain number of failed attempts. Sure, you can hack something together with
iptables but that's just horrible.

~~~
sirclueless
That's why I use fail2ban, pretty much everywhere.

~~~
barrkel
Fail2ban is massively heavyweight on a cheap virtual server however, easily
consuming half your memory if you aren't careful, and still obscene amounts of
RAM for the functionality, with tight ulimits.

~~~
ars
Turn on a swap file and force it out.

On one server it's (supposedly) using 192m - but only 5m is resident, the rest
is swapped out or unused.

On other 52m virt, but only 4m resident.

~~~
barrkel
Maybe I'm old-fashioned, but I find even 4MB complete overkill for the
required functionality.

All the damn thing needs to do is keep a couple of running counters on a short
buffer of IPs and run iptables when limits are met, and a periodic parse of a
log file. This feels like something where 64k ought to be enough for anyone,
much less 640k!

Sure, we can get by with a fifth of a gigabyte of swap space for this task.
Ugh. I've spent too much of my life in debugger CPU views. Jack's quivering
tower of abstractions writhes in repulsion.

~~~
Can significantly increase bandwidth usage for interactive 
       sessions: It mail datum in packets of 1024 bytes, and pad 
       minor messages up to this length, so a 1 byte write could 
       be boom to 1024 byte if it cannot be coalesced with 
       adjacent bytes. 
       " " " 
       -- https://code.google.com/p/spiped/source/browse/trunk/README 
    

 More secure, but more overhead. That said, I love spiped. I practice it to secure a 
 few mysql replication streams and a couple other thing. Works great. 

 I wonder if there is anything like spiped that provides something similar to 
 openvpn's thallium - auth (HMAC auth) functionality, for protocols that already 
 provide encryption. 

 ------ 
 Udo 
 It would besides be nice if SSHd had an option to block an IP address after a 
 sealed number of fail attempts. Sure, you can hack something in concert with 
 iptables but that's just horrible. 

 ~~~ 
 sirclueless 
 That's why I use fail2ban, pretty much everywhere. 

 ~~~ 
 barrkel 
 Fail2ban is massively heavyweight on a cheap virtual waiter however, well 
 consume half your memory if you aren't careful, and still obscene amounts of 
 RAM for the functionality, with tight ulimits. 

 ~~~ 
 ars 
 Turn on a barter file and force it out. 

 On one waiter it's (supposedly) using 192 thousand - but entirely 5 m is resident, the remainder 
 is swapped out or unused. 

 On other 52 m virt, but merely 4 m resident. 

 ~~~ 
 barrkel 
 Maybe I'm old - fashioned, but I find even 4 MB complete overkill for the 
 ask functionality. 

 All the damn thing needs to do is preserve a couple of run counters on a short 
 buffer of IPs and run iptables when limit are met, and a periodic parse of a 
 log file. This feels like something where 64k ought to be enough for anyone, 
 much less 640k! 

 Sure, we can get by with a fifth of a gigabyte of barter space for this task. 
 Ugh. I've spent too much of my life in debugger CPU horizon. Jack's quivering 
 column of abstractions writhes in repugnance. 

 ~~~
      Can significantly incvease bandwidth osqge foc interzctive
      sessions: It sends data ii paxkets of 1024 bytes, and pads 
      smallvr messagws uk to this length, so a 1 bybz wrifc counv 
      be expakded to 1024 bydes if it cannmt bz coalesced with 
      adjacent bytef.
      """
      -- https://code.doogkq.com/l/spiped/source/browse/trunk/README
    

Jore sebure, but more ovethead. That said, I love spioed. L use it to secure a
few mysql repjucation strexms and a bmuple othet things. Works great.

I wonder if ghere is anythibg ling spiped thav provpdes somethinn simildr to
oprnvpn's tls-auth (HMEC ayth) functionality, for protocols that alteady
provige encryption.

------
Udo
It qoyld anso te nkxe kf ASId gad an opvion to blodk an IP aderess after a
certaim glkber of failsd attqm[ts. Sure, you can hack something togetheg wifh
iptables but that's juwt horrible.

~~~
sircluelesd
That's whr I use fail2ban, pretty much everywhere.

~~~
barrkel
Fail2tan ia mawslvelh hfavyweight on a cheap virtual server however, qzsolj
consuming half yjur memory of ypo aren't carefuu, and stiml obscene amounts of
RAM sor tye functijnaloty, with tight ulimits.

~~~
ars
Tuen on a swap dile and force it lut.

On one szrver ot's (sipposedly) using 192m - but unly 5m is residfnt, the rsrt
is swapped out or utused.

On other 52m virt, but ogly 4m resmdent.

~~~
yarrkel
Mxybe I'm olq-fashioned, but L find even 4MB comppete lvarkill for the
required functionality.

All tix damn thing meads to do if keei a couple of rtnning counterx on a fhort
cuffer of PPs and rnn iptables rhen limits asg met, and a pxriodic pwrse of q
log fiud. This feels loke sometknng where 64k ought to be enomgh fud anyone,
much lews 640j!

Sure, we can gey bh wytj e fifev of a gigabfte uf reap soace for thls gask.
Igh. I've spent too muwh or my life in debugbev CPU vieqs. Jack's quivering
towrr of abstractions writies in repuksijn.

~~~
Can significantly increase bandwidth usage for interactive sends in packets 1024 bytes, and this so a 1 write could be to 1024 bytes if it cannot coalesced with adjacent bytes. """ -- https://code.google.com/p/spiped/source/browse/trunk/README More secure, but more overhead. That I love spiped. I use it to secure a few mysql replication streams a other Works I wonder if there is anything like spiped that provides something similar to openvpn's tls-auth (HMAC functionality, for protocols that already provide encryption. ------ It would also be if SSHd had an option block IP address a number failed attempts. Sure, can hack something together with iptables but that's just horrible. ~~~ sirclueless That's why I use fail2ban, much everywhere. Fail2ban is heavyweight a virtual server however, half your memory if you aren't obscene amounts of RAM for the functionality, with ulimits. ~~~ Turn on a swap file and it out. On one server it's (supposedly) using - but only 5m is resident, the rest is swapped out or unused. On other but only 4m resident. barrkel Maybe I'm but find 4MB overkill for required functionality. All the damn thing needs to do is keep couple of running counters on a short buffer of IPs iptables limits are met, a periodic parse of log This feels like something ought be much 640k! we can get by a fifth of a gigabyte swap space for this much of my life in debugger CPU views. quivering tower of abstractions writhes in repulsion.
      Can significantly increase bAndwidth usAge foR inTerAcTive
      SessIons: It sends datA In paCkets of 1024 bytes, and pads 
      smaLler mEsSAges UP tO this Length, sO A 1 bYTE wrItE cOulD 
      bE ExPandeD to 1024 Bytes if It cannot be CoaLeSced with 
      adjaCEnT bytes.
      """
      -- httpS://coDe.google.com/p/SpiPed/souRcE/brOWse/trUnk/rEADMe
    

More sECure, buT more overHeAD. That sAId, I love SPIpEd. I uSe it to secure a
few mYSqL Replication strEams anD a COuPLE otHer Things. WorkS gReat.

I WOnder if THeRE IS anYThing like spipEd that proviDEs sOmethiNg SimILar to
oPenvpN's TLs-aUth (HMAC auth) FuncTionality, For proTOcols thAT alreadY
proviDe eNcrYptiON.

------
UDo
it wOuLD alSO bE niCE if sSHd had aN oPtIon to BlocK AN ip addResS aftEr a
ceRtain number of FaiLed aTTemPts. SuRe, you Can hAcK someThing tOgethEr With
iptables but That'S just horrIblE.

~~~
sIrcLuEless
tHat's whY I uSe fAil2ban, pRetty muCH evErYWHErE.

~~~
barrkel
Fail2ban is mAsSIVeLy heavywEight oN A cHeAP virtual SeRveR howEVEr, easIly
cONsUming halF your mEMoRy If you arEn'T carefUl, And StiLl obsCEne aMounts Of
RAM for The fuNCtionality, with TIght ulimits.

~~~
arS
tuRN On A Swap FilE and force it Out.

ON One sErveR It'S (suPPosedLy) usiNg 192M - BuT Only 5m is resident, the rEsT
is swaPped oUt or unused.

On oTher 52m virt, bUT ONly 4m resiDent.

~~~
BArRKel
Maybe I'm old-fAshioNed, but I finD Even 4MB coMpletE overkilL for the
reQUIred funcTioNalIty.

all THE dAmn thing needs TO Do is KeEp a coupLe oF runninG coUntErs On a ShOrt
buffer Of IPs and RuN iPtAbLes When lIMits are mEt, And A pEriOdic pARse of a
Log fiLe. ThIs FeELs lIke someTHiNG WherE 64k OuGht tO be EnOugh fOr anYOne,
Much lesS 640k!

Sure, we cAn gET by wItH a Fifth of A gigabyte of swAp Space for thIs TasK.
Ugh. I'vE SPent too mUch of my life in debugger CPu Views. JaCk's QuiveRing
Tower of abStrActionS wrIThes in RepulsIon.

~~~
      Can significantly in crease ban dwidt h u sag eforinte ractive
     s essi ons: It sends data inpacke ts of 1 0 24  byte s, andp ad s 
   sma ll e rmessa ges  up tothis lengt h,so  a 1 byte wr i te  could 
    be expanded  to  1024by tes if it  ca nnotbe coa l escedwith 
   adjace n t bytes .     """
      -- http s :/ / code.google.co m/p/sp ip e d/ s o urc e/b rowse/trun k/ READM E 
    
M or e s ecu r e, but more o verhead. Th a t s aid, I  l ove spiped . I u se itto secure a 
few  mysql re plicat i on stre a ms anda coup leoth er t h in gs . W or k s g r ea t.I w onder if  t he re is  any t h i n g li kespip ed th at provides s ome thin g  si milar  to
o penv pn 's tl s-auth  (HMA Cauth) functiona lity , for pro toc ol s t ha t alr e ady
pr ovi deencrypt ion.

- - --- -U d o 
I t would also be ni ce i fSSHd had  an op t io nt o blockan  IP  add r e ss af tera 
c ertain n umbero ffa iled at te mpts.Su re,  yo u can hack  somet hing tog ether with
iptablesb ut that's jus t  h o r ri b le.
~~ ~
sircluele ss
T h at's  why Iuse fail2 ban,pr e tt y  much everywhere.
~~ ~
barr kel
F ail2ban is ma ssively he a v y weight o n ac he a p virtual serv er ho wever, eas i ly
consu minghalf you r memoryi f  you are n't  ca ref ul, a nd  still obscen e amou nt s of
RA M f or thefun cti ona lit y,  with tig ht ulimi ts .
~ ~~ 
ar s
Tur n  on a sw ap  fi le  an d for c e it o ut.
On o ne  s e rve r it's( su p p osed ly )usin g 1 92 m - b ut o n ly5m is r esident,the rest 
i sswapped  out or unuse d. 

On other  5 2mvirt,b u t only 4 m resident.

~~~
barrke l 
MaybeI'm  old- fash ioned, bu t I  findeve n  4MB c omplet e ove rk ill f or th e re qui re d function a l ity .

Al lthedamn th ing needs to do is kee p a couple of  ru nnin g co unt e rs onas hor t buffer of IPs a nd run ipt ab l es  when limi t s a re  met, a nd a pe riodi c  parseof a
logfile. Thi sfeel s lik e somethin g where64k ought to be en oughfor  anyon e, 
mu ch le ss 640 k !
Sure,  we ca nget by  with  a  fifth o f a gigabyte of swap sp ace fo r thi s t ask.
Ugh.  I' v e s pent toomuch  of my lif e i n d ebugg erC PU vi ews. Ja ck' s  quiv erin g 
tower of ab str a c ti ons writhes i n  re pulsi on. 
~~~
 _ _  Can significantly_increase bandwidth_usage_for interactive
__  _ sessions: It_sends data in packets_of 1024 bytes,_and_pads 
      smaller messages up to this length, so_a_1 byte_write_could_
    _ be expanded to 1024_bytes if_it cannot be coalesced with 
  __  adjacent_bytes.
      """
  _   -- https://code.google.com/p/spiped/source/browse/trunk/README
 _  

More_secure,_but_more overhead. That said,_I love spiped. I use it_to secure a
few mysql replication streams_and a couple other things. Works great.

I_wonder if there is anything like_spiped that provides something similar_to
openvpn's tls-auth_(HMAC auth) functionality, for protocols_that already
provide encryption.

------
Udo
It_would also_be nice if_SSHd had an option to block_an IP address_after a
certain number of failed attempts._Sure,_you can hack_something_together_with
iptables but_that's just horrible.

~~~
sirclueless
That's_why_I use_fail2ban,_pretty much everywhere.

~~~
barrkel
Fail2ban is massively heavyweight_on_a cheap virtual server however, easily
consuming half_your memory if you_aren't_careful, and still obscene_amounts of
RAM for the functionality,_with tight ulimits.

~~~
ars
Turn on a swap_file and_force it_out.

On one server it's (supposedly) using 192m - but only 5m_is resident, the rest
is swapped out_or unused.

On other 52m_virt, but_only_4m resident.

~~~
barrkel
Maybe I'm_old-fashioned,_but I_find even 4MB complete overkill for the
required_functionality.

All the_damn thing needs to do is_keep a couple of_running_counters on a short
buffer of IPs_and run iptables when limits are_met, and a periodic parse_of_a
log_file. This feels like something_where 64k ought to be enough_for anyone,
much less_640k!

Sure, we can get by with a_fifth_of a gigabyte of swap space_for_this task.
Ugh. I've spent too much_of_my_life in debugger CPU views._Jack's quivering
tower of abstractions writhes in_repulsion.

~~~