I rarely have to think about stuff at this level, but am I interpreting how this works right?
When a remote login fails on these devices, it kills its ssh server process, waits a certain amount of (time * how many failed attempts)ms, then starts it back up?
But if you truly hammer at one of these devices you could force it to reboot, which makes it forget the counter, so an attackers gets an unlimited number of the “cheapest” guesses (though it’d still slow it down a bit).
The solution is the machine physically writes the memory from RAM into onboard FLASH mem, and is reading/writing the count variable to a file instead of just using a variable.
FLASH memory is the type that keeps state as long as it has a trickle of power, so as long as the device is plugged in, this is essentially “long term” storage (but not truly like a hdd would be).
A reboot will wipe the systems RAM (because you don’t want any bad state from behaviour lurking around), but not the FLASH. And because it doesn’t ever physically cut the power the FLASH persists and the intended increasingly harsh punishment for failed logins works.
Lower level stuff is awesome.