Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Endlessh: An SSH Tarpit

nullprogram.com

Post reply on HN
Print view View original

61–70 of 118 posts

Re: Endlessh: An SSH Tarpit

#61

Post by JohnFen »

tyingq wrote: post #40
sverige wrote: post #26

Earlier quoted context omitted.

Why worry about pissing off the kind of person who scans for open SSH ports for no apparent legitimate reason? Are you concerned that the Chinese are going to try even harder to hack your machine, like they're not already doing everything they can to break in?

They may be the same type of person that would launch a ddos, for example.

I'm not concerned about this, personally.

On my home server, there are only two ports open to the internet -- one for my SSH server, and one for my VPN server. Both of those are running on nonstandard ports.

In order to DDOS me, an attacker has to find those ports, which would require a comprehensive scan (increasing the chances that they'll get blocked by my ISP or detected by my antiscan monitor) or a huge amount of luck. And even then, they'll just be able to DDOS my SSH server and VPN. That wouldn't be awesome, but wouldn't exactly be disastrous.

Re: Endlessh: An SSH Tarpit

#62

Post by rwbhn »

def8cefe wrote: post #57
zylent wrote: post #54

Earlier quoted context omitted.

If you have an ARIN allocation, there is no reason you would ever want to decrease the amount of addresses you own. You own them.

Whether you own them or not is subject to a lot of debate and not clear cut. If you owned them, why would you need to fool ARIN into believing they are being utilised? The agreement you make to get an allocation requires a certain level of utilization depending on the size of the block to prevent squatting and exhaustion of resources. This is a good thing, and if it was actually respected we wouldn't be in a mad rush…

"Mad rush" - heh. I'd hate to see how long something rolled out at a leisurely pace would take!

Re: Endlessh: An SSH Tarpit

#63

Post by JohnFen »

LinuxBender wrote: post #22
GNOMES wrote: post #14

I must not be understanding something... Does this still allow whitelisted machines to connect, or is this just a troll thing to do?

I could see a few ways to use this. For me, what makes sense for my public sftp servers is to put this on a higher port, then use ipset lists to dynamically add bots to a DNAT rule and send them to this instead of the proper sshd. i.e. you get 2 chances to authenticate correctly, then I put you in this hamster wheel for a day. Hamster wheels and intermittent fasting are all the rage these days.

I was thinking of something similar, but in reverse -- turn this into part tarpit, part honeypot.

I was thinking I could take the IP address of anyone who hangs out in the tarpit for longer than a minute or so and automatically add it to my firewall's blacklist.

Re: Endlessh: An SSH Tarpit

#65

Post by 1996 »

LinuxBender wrote: post #2

I like this! It's tiny, simple, yet effective. 2019-03-22T19:54:06.303Z ACCEPT host=::ffff:196.52.43.xx port=50327 fd=4 n=1/4096 2019-03-22T19:54:38.838Z CLOSE host=::ffff:196.52.43.xx port=50327 fd=4 time=32.535 bytes=199 2019-03-22T19:57:12.008Z ACCEPT host=::ffff:141.98.81.xx port=53646 fd=4 n=1/4096 2019-03-22T19:57:21.118Z CLOSE host=::ffff:141.98.81.xx port=53646 fd=4 time=9.110 bytes=30 The 141 bot never stays…

Suggestion for Debian: if you get error: unrecognized command line option ‘-fstack-clash-protection’; did you mean ‘-fstack-protector’, do:

echo "deb http://ftp.us.debian.org/debian/ testing main non-free contrib deb-src http://ftp.us.debian.org/debian/ testing main non-free contrib" > /etc/apt/source.list.d/debian-testing.list

apt-get update

apt-get install gcc-8/testing

The Makefile can then contain the above line:

    CFLAGS  = -std=c99 -Wall -Wextra -Wno-missing-field-initializers -D_FORTIFY_SOURCE=2 -O2 -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -ftrapv -s -g -Wl,-z,relro,-z,now -Wl,-z,noexecstack -pipe -Wp,-D_GLIBCXX_ASSERTIONS -fstack-protector-strong -fstack-clash-protection --param ssp-buffer-size=4 -fPIE -pie -m64 -mtune=generic
and:

CC = gcc-8

Replace -mtune=generic by your CPU, cf https://wiki.gentoo.org/wiki/Safe_CFLAGS

Re: Endlessh: An SSH Tarpit

#66

Post by maga_2020 »

very interesting, and useful (including newbies like me who do not appreciate the complexities and dangers of having internet-accessible IP address).

I wonder if security-oriented OSs like openBSD could offer something like this out of the box. So that an admin can just say enable_tarpits='yes', and it would automatically enable tarpits like this for all the currently installed packages (with some default ports).

Re: Endlessh: An SSH Tarpit

#67

Post by 1996 »

JohnFen wrote: post #63
LinuxBender wrote: post #22

Earlier quoted context omitted.

I could see a few ways to use this. For me, what makes sense for my public sftp servers is to put this on a higher port, then use ipset lists to dynamically add bots to a DNAT rule and send them to this instead of the proper sshd. i.e. you get 2 chances to authenticate correctly, then I put you in this hamster wheel for a day. Hamster wheels and intermittent fasting are all the rage these days.

I was thinking of something similar, but in reverse -- turn this into part tarpit, part honeypot. I was thinking I could take the IP address of anyone who hangs out in the tarpit for longer than a minute or so and automatically add it to my firewall's blacklist.

I used to run an honeypot.

For fun and giggles, I also kept the user and password they tried to see if any of my systems was at risk

Re: Endlessh: An SSH Tarpit

#68

Post by nemo1618 »

throwaway2048 wrote: post #12
nemo1618 wrote: post #8

Earlier quoted context omitted.

A program like this has vastly less attack surface than a full SSH protocol implementation. In particular, it doesn't support the part of the SSH protocol that allows executing commands on a remote host. So the only way this will be less secure than OpenSSH is if there's some memory unsafety or a leak of some kind.

almost all of the SSH protocol isn't exposed until you authenticate, and in the vast majority of setups that means you get a shell to execute commands with anyways, so while still important, the key problems are with pre-auth security.

Sure, but "isn't exposed" is very different from "that functionality is physically not present in this executable."

Re: Endlessh: An SSH Tarpit

#69

Post by crtasm »

JohnFen wrote: post #61
tyingq wrote: post #40

Earlier quoted context omitted.

They may be the same type of person that would launch a ddos, for example.

I'm not concerned about this, personally. On my home server, there are only two ports open to the internet -- one for my SSH server, and one for my VPN server. Both of those are running on nonstandard ports. In order to DDOS me, an attacker has to find those ports, which would require a comprehensive scan (increasing the chances that they'll get blocked by my ISP or detected by my antiscan monitor) or a huge amount o…

If your IP doesn't change that often or is static, I'm curious how much Shodan knows about your open ports?

Re: Endlessh: An SSH Tarpit

#70

Post by btown »

imglorp wrote: post #41
xoa wrote: post #35

Neat little project to needle some of the botters a bit (though I assume they'll all evolve to recognize this fairly quickly). I'd echo tyingq's comment below though: Any tarpit has the potential to piss someone off. I'd run it on a sacrificial server with no obvious way to tie back to who is running it. Yeah, just speculating but at least from what I've seen in the past if you successfully tarpit some script kiddie…

Good advice, being ready for a revenge DDOS, but I suspect most of these SSH hunters are busy business people who have a quota of zombie hosts to fill for whatever mining or spamming they're up to. DDOSing doesn't pay like those things do.

Even sophisticated/organized hackers have free time, and if someone "messed with them" and caused them to need to push a hotfix at 6pm on a Friday because their cluster got stuck on your tarpit, you can bet they'll give the tarpit operator some of their attention. Woe to you if they happen to find something that's not patched.
Post reply on HN