Endlessh: An SSH Tarpit
nullprogram.com
Endlessh: An SSH Tarpit
1–10 of 118 posts
Re: Endlessh: An SSH Tarpit
#2I like this! It's tiny, simple, yet effective.
2019-03-22T19:54:06.303Z ACCEPT host=::ffff:196.52.43.xx port=50327 fd=4 n=1/4096
2019-03-22T19:54:38.838Z CLOSE host=::ffff:196.52.43.xx port=50327 fd=4 time=32.535 bytes=199
2019-03-22T19:57:12.008Z ACCEPT host=::ffff:141.98.81.xx port=53646 fd=4 n=1/4096
2019-03-22T19:57:21.118Z CLOSE host=::ffff:141.98.81.xx port=53646 fd=4 time=9.110 bytes=30
The only thing missing is setting some glibc hardening options
RELRO STACK CANARY NX PIE RPATH RUNPATH FORTIFY Fortified Fortifiable FILE
Partial RELRO No canary found NX enabled No PIE No RPATH No RUNPATH No 0 8 ./endlessh
CFLAGS = -std=c99 -Wall -Wextra -Wno-missing-field-initializers -D_FORTIFY_SOURCE=2 -O2 -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -ftrapv -s -g -Wl,-z,relro,-z,now -Wl,-z,noexecstack -pipe -Wp,-D_GLIBCXX_ASSERTIONS -fstack-protector-strong -fstack-clash-protection --param ssp-buffer-size=4 -fPIE -pie -m64 -mtune=generic
RELRO STACK CANARY NX PIE RPATH RUNPATH FORTIFY Fortified Fortifiable FILE
Full RELRO Canary found NX enabled PIE enabled No RPATH No RUNPATH Yes 3 4 ./endlesshRe: Endlessh: An SSH Tarpit
#3Is a poll necessary?
Simple timer to count to 10. Go over all open sockets, drain incoming, pump junk. Handle accept. Repeat.
Re: Endlessh: An SSH Tarpit
#4This is awesome. Like the author, I run my real SSH server on a nonstandard port. Unlike the author, I run nothing on the standard SSH port.
I think that I'll start running this there.
Re: Endlessh: An SSH Tarpit
#5I'm not sure I like this. How secure is it? Anything you put on port 22 is going to be attacked relentlessly. I think I'd rather have OpenSSH handling those attacks than some tarpit program that may or may not have been subjected to the audits and the trial-by-fire that OpenSSH has.
Re: Endlessh: An SSH Tarpit
#6Ewww, sticky service! Hilarious! :-D
Re: Endlessh: An SSH Tarpit
#7I haven't used it in years, but Tom Liston's "Labrea" tarpit is an interesting take on this concept: https://github.com/Hirato/LaBrea
It listens in your unused IP space and both tar-pits scanners and creates actionable intelligence about scans against your hosts.
Re: Endlessh: An SSH Tarpit
#8I'm not sure I like this. How secure is it? Anything you put on port 22 is going to be attacked relentlessly. I think I'd rather have OpenSSH handling those attacks than some tarpit program that may or may not have been subjected to the audits and the trial-by-fire that OpenSSH has.
A program like this has vastly less attack surface than a full SSH protocol implementation. In particular, it doesn't support the part of the SSH protocol that allows executing commands on a remote host. So the only way this will be less secure than OpenSSH is if there's some memory unsafety or a leak of some kind.
Re: Endlessh: An SSH Tarpit
#9I'm not sure I like this. How secure is it? Anything you put on port 22 is going to be attacked relentlessly. I think I'd rather have OpenSSH handling those attacks than some tarpit program that may or may not have been subjected to the audits and the trial-by-fire that OpenSSH has.
Any tarpit has the potential to piss someone off. I'd run it on a sacrificial server with no obvious way to tie back to who is running it.
Re: Endlessh: An SSH Tarpit
#10I'm not sure I like this. How secure is it? Anything you put on port 22 is going to be attacked relentlessly. I think I'd rather have OpenSSH handling those attacks than some tarpit program that may or may not have been subjected to the audits and the trial-by-fire that OpenSSH has.
It's as safe as it can get. None of the versions he showed in the post actually read any data from the attacker. It only accepts the connection, then writes random data to it every 10 seconds forever.