TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Endlessh: An SSH Tarpit

290 点作者 elliebike超过 4 年前

15 条评论

xoa超过 4 年前
Are tarpits still of use these days? I sort of figured that even modern script mass attackers have gotten professionalized and sophisticated enough that they can deal with trivial timeouts and the like. I could see actual honeypots still being of use for researchers or blue teams at organizations that are real targets, and ML might even open up some interesting new ways to make those more engaging for longer. But a tarpit doesn&#x27;t seem like it&#x27;d cause bother for drive-by or APT, the former are all about volume so if something takes more than a few seconds just skip it (and maybe flag it as a tarpit for punishment) and an APT will instantly recognize it too.<p>For individuals and smaller orgs I&#x27;ve sort of felt like keeping your head down, running a wg&#x2F;ssh bastion with a non-standard port maybe along with single packet auth or even plain old port knocking to reduce log spam from random drive-by is more effective and attainable for places without any sort of dedicated security or even constant in-house IT staff. Running a tarpit on a VPS seems like it&#x27;d fail to bother most these days, and running it on an actual IP seems like at best it&#x27;d have no effect and at worst if it ever actually held up a scanner and the operator noticed they might decide to direct some actual attention to that IP, or at least throw a mild ddos at it for a bit. Am I wrong or out of date on that? I&#x27;m all for sticking it to bad actors and efforts to reduce the economic incentives, but in 2020 tarpits strike me as kind of obsolete with some risk to boot.
评论 #24492452 未加载
评论 #24493469 未加载
评论 #24493990 未加载
评论 #24492887 未加载
评论 #24492357 未加载
评论 #24497833 未加载
评论 #24492708 未加载
DarkWiiPlayer超过 4 年前
Reminds me of the dungeon I built for web crawlers to have fun collecting email addresses at <a href="https:&#x2F;&#x2F;darkwiiplayer.com&#x2F;bot-dungeon" rel="nofollow">https:&#x2F;&#x2F;darkwiiplayer.com&#x2F;bot-dungeon</a> xD
评论 #24492716 未加载
评论 #24494113 未加载
评论 #24492093 未加载
评论 #24492048 未加载
评论 #24491921 未加载
tptacek超过 4 年前
I&#x27;m sure this was fun to put together and it seems like it&#x27;s fun for people to talk about, but you can put this along with fail2ban, port knocking, and nonstandard SSH ports in the back of the attic and just (1) turn off password authentication entirely and (2) put SSH behind WireGuard. Even if you don&#x27;t do step (2), step (1) eliminates the rationale for all the silly stuff people do to obfuscate their SSH installs.
评论 #24529867 未加载
评论 #24496265 未加载
Lex-2008超过 4 年前
discussion of a blog post about this tool: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=19465967" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=19465967</a>
Freaky超过 4 年前
One I made in async Rust: <a href="https:&#x2F;&#x2F;github.com&#x2F;Freaky&#x2F;tarssh" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;Freaky&#x2F;tarssh</a><p>I currently have 22 clients stuck it in across three machines. When I started out it was more like a thousand, so seems they&#x27;ve largely adapted.
nickcw超过 4 年前
Great idea!<p>I&#x27;m not sure we should be writing new network connected daemons in C though.
评论 #24491785 未加载
评论 #24493308 未加载
评论 #24500450 未加载
geocrasher超过 4 年前
I have to admit that I tried this and it was rather lackluster. Log output:<p><a href="https:&#x2F;&#x2F;pastebin.com&#x2F;4FTHRF3f" rel="nofollow">https:&#x2F;&#x2F;pastebin.com&#x2F;4FTHRF3f</a><p>Not a lot of activity over the time I ran it, and I know that the port gets hit more than that. I had a much better time when I ran a honeypot with Kippo:<p><a href="https:&#x2F;&#x2F;github.com&#x2F;desaster&#x2F;kippo" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;desaster&#x2F;kippo</a><p>It was much more useful as it gave me a great list of IP&#x27;s to block from all my systems ;)
评论 #24496586 未加载
k33n超过 4 年前
The tarpit approach is a double-edged sword. Sure, you&#x27;re keeping some script kiddie&#x27;s machine locked up (maybe), but you&#x27;re also keeping socket connections open and wasting resources on the machine they are targeting. A much more efficient approach is using fail2ban and a firewall to just drop traffic from offenders.
评论 #24493199 未加载
评论 #24497960 未加载
评论 #24493210 未加载
dclaw超过 4 年前
Hah, I love endlessh.... been running it for a few years now on one of my digital ocean droplets. Better to fuck with these bots. My personal record was somewhere around 23 days having one stuck.
nirui超过 4 年前
What got my inspired here is, if a simple delay strategy can make attack harder, why not add this as a common feature in SSH?<p>It can be called &quot;Initial Connection Delay&quot;: Once a new TCP connection is established, wait for an uncertain number of n seconds before read and respond to the handshake request.
password4321超过 4 年前
One of the simplest ways to block unwanted connections is to filter on client id. I haven&#x27;t seen anyone willing to change it even though I&#x27;ve blocked libssh, sshgo, and paprika.<p>Of course, this functionality is only available in non-standard SSH servers such as the one from Bitvise.
clon超过 4 年前
This is like a self-administered &quot;slow lori attack&quot; then - making it easier for an attacker to keep connections up until things start getting tight on port 443.
评论 #24491706 未加载
earthboundkid超过 4 年前
<a href="https:&#x2F;&#x2F;github.com&#x2F;carlmjohnson&#x2F;heffalump" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;carlmjohnson&#x2F;heffalump</a>
评论 #24503954 未加载
seqizz超过 4 年前
I&#x27;d rather have a trusted common list of known abusers&#x27; IPs. But I think that&#x27;s harder to maintain.
评论 #24492258 未加载
评论 #24493436 未加载
verroq超过 4 年前
This would have been fun to put onto production machines. We had a botnet that was running ssh bruteforce with 10s requests per second with unique IPs. It stopped after we disabled password auth.
评论 #24493269 未加载