1#	$OpenBSD
2#	Placed in the Public Domain.
3
4tid="penalties"
5
6grep -vi PerSourcePenalties $OBJ/sshd_config > $OBJ/sshd_config.bak
7cp $OBJ/authorized_keys_${USER} $OBJ/authorized_keys_${USER}.bak
8
9conf() {
10	test -z "$PIDFILE" || stop_sshd
11	(cat $OBJ/sshd_config.bak ;
12	 echo "PerSourcePenalties $@") > $OBJ/sshd_config
13	cp $OBJ/authorized_keys_${USER}.bak $OBJ/authorized_keys_${USER}
14	start_sshd
15}
16
17conf "noauth:10s authfail:10s max:20s min:1s"
18
19verbose "test connect"
20${SSH} -F $OBJ/ssh_config somehost true || fatal "basic connect failed"
21
22verbose "penalty expiry"
23
24# Incur a penalty
25cat /dev/null > $OBJ/authorized_keys_${USER}
26${SSH} -F $OBJ/ssh_config somehost true && fatal "authfail connect succeeded"
27sleep 2
28
29# Check denied
30cp $OBJ/authorized_keys_${USER}.bak $OBJ/authorized_keys_${USER}
31${SSH} -F $OBJ/ssh_config somehost true && fatal "authfail not rejected"
32
33# Let it expire and try again.
34sleep 11
35${SSH} -F $OBJ/ssh_config somehost true || fail "authfail not expired"
36