For CTF on shared servers, there need to be some explicit rules about DOSing shared resources; otherwise things get really dull really fast.

If people are going to be using brute-force tactics, they're probably each going to need separate virtual machines.