Guarding against SSH denial of service

I have found a program which implements an effective DoS attack against the SSH service. Basically, the program just opens a large number of connections to any SSH server, but doesn't try to provide any password. This means that nobody can connect and authenticate to the SSH server anymore, and if SSH is the only means of connecting that basically means the server operator is screwed. I've tested it on my own servers. It works very well, but what worries me is that there seems to be no way of guarding against it. The attack isn't useful for people who actually want to get access to the system, but I could see someone using it if I pissed them off, for example. I'm a security noob, does anyone have an idea of how this could be guarded against? Only allowing 1 unauthenticated connection per IP might do the trick for most attackers, but then botnet operators could easily get around this restriction without creating enough network traffic to be visible, or even using a significant amount of resources on the attacker's computers. https://github.com/isislab/screwSSH

For a single (or a handful of) attackers, lowering the grace time and installing something like fail2ban with aggressive banning should do it. If you have to defend yourself against a botnet, there isn't much you can do because you can never differentiate between a new bot-IP and a legitimate login-attempt of an operator - if you could, e.g. because you have some trusted IP or IP-range, just use a whitelist. The last resort in this case, as far as I'm aware, is to use some security-through-obscurity like port-knocking and setting your ssh port to some random high number.

>>4692 >port-knocking I think this would be the best way to protect against this. From that github page, it says it only needs to have 10 connections which is a such a small number that an attacker can just do one per IP which as you said makes fail2ban not effective.