MaxDisplays configuration option

[AG]

Hello,

I manage OpenSSH on a dozen or so servers that act as gateways for a large
amount of developers and system administrators. On these servers it is
common for there to be more than 1000 active X11 forwards active at peak
usage. Beyond ~1000 active X11 forwards, sshd will fail to bind additional
ports due to a hard coded range check in channels.c that limits the port
range that sshd will attempt to bind. Today this is set at 1000:

channels.c:152:#define MAX_DISPLAYS 1000

I have made changes to OpenSSH portable that allow this setting to be
configured via an option in sshd_config named MaxDisplays. If not
explicitly set, it maintains the default value of 1000.

It seems to me that this setting should be configurable by the user similar
to how X11DisplayOffset is configurable. I've read the code carefully and
am currently using this patch in my production environment without any
issues. I don't see any reason this change would cause any issues for users
that do not need to explicitly set it. I also don't envision this being a
maintenance burden as it's a very simple feature.

I'd appreciate this being considered for acceptance into OpenSSH.

Also, I'm curious if this issue has ever come up before? Is it really that
strange of a case?

I understand that you don't utilize GitHub for development, but for
convenience you can see the changes in a web browser:

https://github.com/openssh/openssh-portable/pull/41

I've attached the patch to this message as well.

Thanks,
Adam

[Nico Kadel-Garcia]

Post by AG
Hello,
I manage OpenSSH on a dozen or so servers that act as gateways for a large
amount of developers and system administrators. On these servers it is
common for there to be more than 1000 active X11 forwards active at peak
usage. Beyond ~1000 active X11 forwards, sshd will fail to bind additional
ports due to a hard coded range check in channels.c that limits the port

I think your development environment is insane, but that's your
problem, not mine.

Post by AG
channels.c:152:#define MAX_DISPLAYS 1000
I have made changes to OpenSSH portable that allow this setting to be
configured via an option in sshd_config named MaxDisplays. If not
explicitly set, it maintains the default value of 1000.

This would seem a sane approach. I do hope you'll also document the
change in the man page for sshd_config? I never have noticed
documentation for the "sshd -r" option, though it still seems to
exist. Options that are not documented..... are a long source of
cofusion for many projects.

Post by AG
It seems to me that this setting should be configurable by the user similar
to how X11DisplayOffset is configurable. I've read the code carefully and
am currently using this patch in my production environment without any
issues. I don't see any reason this change would cause any issues for users
that do not need to explicitly set it. I also don't envision this being a
maintenance burden as it's a very simple feature.
I'd appreciate this being considered for acceptance into OpenSSH.
Also, I'm curious if this issue has ever come up before? Is it really that
strange of a case?

From decades in the field, I'd say It's pretty weird. I've not
personally seen anything approaching that number of clients on a
single server in..... well, not since I worked with Multics back in
the 1980's. Dozens on a robust system, yes. One thousand?

Post by AG
I understand that you don't utilize GitHub for development, but for
https://github.com/openssh/openssh-portable/pull/41
I've attached the patch to this message as well.
Thanks,
Adam

[Alexander Wuerstlein]

Post by Nico Kadel-Garcia

Post by AG
Also, I'm curious if this issue has ever come up before? Is it really that
strange of a case?

From decades in the field, I'd say It's pretty weird. I've not
personally seen anything approaching that number of clients on a
single server in..... well, not since I worked with Multics back in
the 1980's. Dozens on a robust system, yes. One thousand?

We do have some boxes with concurrent ssh-users in the lower 3-digit
range. But in general this seems to be rare, especially since software
is often unprepared for and untested in that amount of activity (see
e.g. https://github.com/systemd/systemd/issues/1961).

For the number of X displays, there was never any issue, usually since
CPU and memory resources run out long before you run out of display
numbers. Users just pick another box or their laptop, if applications
are slow, so the number of X displays is self-limiting ;)



Ciao,

Alexander Wuerstlein.