diff options
author | Saša Živkov <sasa.zivkov@sap.com> | 2021-02-01 15:49:55 +0100 |
---|---|---|
committer | Saša Živkov <zivkov@gmail.com> | 2021-02-02 14:03:25 +0000 |
commit | 7a1980e9e558e03ae8238127c4703fe6b7d7e480 (patch) | |
tree | b93480d80ff82c000a6fbf6f825923029140f649 | |
parent | 791047f24f1d082832d8908cffbeb17c83918f26 (diff) |
Log when a new SSH connection is rejected due to exceeded limit
When the sshd.maxConnectionsPer got exceeded for a user, new connections
from that user were rejected but we had no trace of that rejection in
our logs.
Log a warning in the error_log for this event. This should help Gerrit
admins in troubleshooting SSH connectivity issues.
Change-Id: Id931f68374afb67a5bef91afbc98a3efbe16b38a
-rw-r--r-- | java/com/google/gerrit/sshd/LogMaxConnectionsPerUserExceeded.java | 42 | ||||
-rw-r--r-- | java/com/google/gerrit/sshd/SshDaemon.java | 4 |
2 files changed, 45 insertions, 1 deletions
diff --git a/java/com/google/gerrit/sshd/LogMaxConnectionsPerUserExceeded.java b/java/com/google/gerrit/sshd/LogMaxConnectionsPerUserExceeded.java new file mode 100644 index 0000000000..6f568b1a5b --- /dev/null +++ b/java/com/google/gerrit/sshd/LogMaxConnectionsPerUserExceeded.java @@ -0,0 +1,42 @@ +// Copyright (C) 2021 The Android Open Source Project +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package com.google.gerrit.sshd; + +import com.google.common.flogger.FluentLogger; +import com.google.inject.Singleton; +import java.io.IOException; +import org.apache.sshd.common.Service; +import org.apache.sshd.common.session.Session; +import org.apache.sshd.common.session.SessionDisconnectHandler; + +@Singleton +public class LogMaxConnectionsPerUserExceeded implements SessionDisconnectHandler { + private static final FluentLogger logger = FluentLogger.forEnclosingClass(); + + @Override + public boolean handleSessionsCountDisconnectReason( + Session session, + Service service, + String username, + int currentSessionCount, + int maxSessionCount) + throws IOException { + logger.atWarning().log( + "Max connection count for user %s exceeded, rejecting new connection." + + " currentSessionCount = %d, maxSessionCount = %d", + username, currentSessionCount, maxSessionCount); + return false; + } +} diff --git a/java/com/google/gerrit/sshd/SshDaemon.java b/java/com/google/gerrit/sshd/SshDaemon.java index a1c057ffc0..f04ff7eadd 100644 --- a/java/com/google/gerrit/sshd/SshDaemon.java +++ b/java/com/google/gerrit/sshd/SshDaemon.java @@ -160,7 +160,8 @@ public class SshDaemon extends SshServer implements SshInfo, LifecycleListener { SshLog sshLog, @SshListenAddresses List<SocketAddress> listen, @SshAdvertisedAddresses List<String> advertised, - MetricMaker metricMaker) { + MetricMaker metricMaker, + LogMaxConnectionsPerUserExceeded logMaxConnectionsPerUserExceeded) { setPort(IANA_SSH_PORT /* never used */); this.cfg = cfg; @@ -240,6 +241,7 @@ public class SshDaemon extends SshServer implements SshInfo, LifecycleListener { setKeyPairProvider(hostKeyProvider); setCommandFactory(commandFactory); setShellFactory(noShell); + setSessionDisconnectHandler(logMaxConnectionsPerUserExceeded); final AtomicInteger connected = new AtomicInteger(); metricMaker.newCallbackMetric( |