Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Endlessh: An SSH Tarpit

nullprogram.com

Post reply on HN
Print view View original

51–60 of 118 posts

Re: Endlessh: An SSH Tarpit

#51

Post by DKnoll »

LinuxBender wrote: post #39
penagwin wrote: post #36

Earlier quoted context omitted.

I'm definitely not going to try this because it sounds like an easy way to get in trouble, but would this work on a host like DO/linode/vultr, etc? Again, this seems really easy to detect

Yes be super careful with Labrea on VPS providers and dedicated server providers. They tend to get upset if you are trying to pick up IP's. In most cases it won't even work on KVM hosts. I've used Labrea on unused address space to make ARIN/RIPE happy back in the day and that was harmless, as entire /16's and /17's were unused. They used to nag about nothing in the /16's being pingable, so Labrea made it all 100% pin…

Why hold onto addresses you're not using? This is against the allocation requirements and lead to the IPv4 exhaustion we have now.

Re: Endlessh: An SSH Tarpit

#52

Post by simias »

Jach wrote: post #47
HashBasher wrote: post #43

I wonder if you could make the attacker crunch out some shah-256 and you can profit by mining Bitcoin.

Not bitcoin but forcing a proof-of-work scheme has been proposed as an anti-DoS measure before: http://www.csc.kth.se/utbildning/kth/kurser/DD143X/dkand12/G...

The original hashcash algorithm was meant to quench email spam which is not completely unrelated.

But in this case I think the parent was proposing tricking the attacker into computing a PoW without realizing it, which sounds pretty tricky.

Re: Endlessh: An SSH Tarpit

#53

Post by simias »

sm4rk0 wrote: post #34
velcrovan wrote: post #20

Earlier quoted context omitted.

almost, but backwards. The bots all know port 22. Only you know which random other port is the real ssh port.

And the second guess would be port 2222, so don't use it for a real ssh server!

I suspect that bots that randomly scan IP addresses for vulnerable hosts don't bother trying anything besides 22. I've been running my sshd on port 622 for a long time and I never get fishy connections (while I'd get at least one a week on port 22).

On the other hand a dedicated attacker who really wants to pwn your server will just scan all the ports and figure out what is listening and where. At this point you're better off implementing some form of port knocking if that's a cause for concern.

That being said, running sshd on port 2222 is probably not a good idea because it's not a privileged port.

Re: Endlessh: An SSH Tarpit

#54

Post by zylent »

DKnoll wrote: post #51
LinuxBender wrote: post #39

Earlier quoted context omitted.

Yes be super careful with Labrea on VPS providers and dedicated server providers. They tend to get upset if you are trying to pick up IP's. In most cases it won't even work on KVM hosts. I've used Labrea on unused address space to make ARIN/RIPE happy back in the day and that was harmless, as entire /16's and /17's were unused. They used to nag about nothing in the /16's being pingable, so Labrea made it all 100% pin…

Why hold onto addresses you're not using? This is against the allocation requirements and lead to the IPv4 exhaustion we have now.

If you have an ARIN allocation, there is no reason you would ever want to decrease the amount of addresses you own. You own them.

Re: Endlessh: An SSH Tarpit

#55

Post by oedmarap »

Neat little tool! Since switching to Teleport I haven't had OpenSSH listening publicly for a while, just reverse proxies. Still, I'll prob spin up a small server for this to observe the patterns and IP locations.

Also, don't think that posting this blog article on March 22 didn't go unnoticed :)

Re: Endlessh: An SSH Tarpit

#57

Post by def8cefe »

zylent wrote: post #54
DKnoll wrote: post #51

Earlier quoted context omitted.

Why hold onto addresses you're not using? This is against the allocation requirements and lead to the IPv4 exhaustion we have now.

If you have an ARIN allocation, there is no reason you would ever want to decrease the amount of addresses you own. You own them.

Whether you own them or not is subject to a lot of debate and not clear cut. If you owned them, why would you need to fool ARIN into believing they are being utilised?

The agreement you make to get an allocation requires a certain level of utilization depending on the size of the block to prevent squatting and exhaustion of resources. This is a good thing, and if it was actually respected we wouldn't be in a mad rush to migrate to IPv6.

Re: Endlessh: An SSH Tarpit

#59

Post by spydum »

imglorp wrote: post #41
xoa wrote: post #35

Neat little project to needle some of the botters a bit (though I assume they'll all evolve to recognize this fairly quickly). I'd echo tyingq's comment below though: Any tarpit has the potential to piss someone off. I'd run it on a sacrificial server with no obvious way to tie back to who is running it. Yeah, just speculating but at least from what I've seen in the past if you successfully tarpit some script kiddie…

Good advice, being ready for a revenge DDOS, but I suspect most of these SSH hunters are busy business people who have a quota of zombie hosts to fill for whatever mining or spamming they're up to. DDOSing doesn't pay like those things do.

Exactly.. figuring out why one host out of 500000 you probed got hung up is generally not a wise use of a bot operators time. Now if enough of these tar pits start showing up you can be sure they will quick patch a time limit to defeat stalls like this.

Re: Endlessh: An SSH Tarpit

#60

Post by JohnFen »

ams6110 wrote: post #5

I'm not sure I like this. How secure is it? Anything you put on port 22 is going to be attacked relentlessly. I think I'd rather have OpenSSH handling those attacks than some tarpit program that may or may not have been subjected to the audits and the trial-by-fire that OpenSSH has.

> How secure is it?

Since it doesn't actually have the ability to do anything, it's pretty darned secure.

Post reply on HN