SSH brute-force attacks still pose a significant risk. See our related paper on SSH auditing driven by attacker's attempts here https://pmcao.github.io/caudit/
Endlessh: An SSH Tarpit
91–100 of 118 posts
Re: Endlessh: An SSH Tarpit
#92Perhaps this could be useful if you ran it on a vast number of ports. Just running it on the one doesn't seem to make an attacker's life much more difficult.
That would be easy to do with an iptables DNAT rule. You can take a large set of ports and forward them to this daemon. iptables -t nat -I PREROUTING -m tcp -p tcp --dport 1:79 -j DNAT --to-destination x.x.x.x:2222 iptables -t nat -I PREROUTING -m tcp -p tcp --dport 81:442 -j DNAT --to-destination x.x.x.x:2222 ...etc Just remember to open those same ports in the INPUT rules. If you get DDoS, then also create NOTRACK…
You truly sound like a bender. Is there a quick start to iptables somewhere? Is iptables the defacto network tool?
And can one prevent ddos using iptables?
Re: Endlessh: An SSH Tarpit
#93If you don't want to waste resources and run a separate service, you can do a very similar thing with just iptables. Look for the TARPIT target. > Captures and holds incoming TCP connections using no local per-connection resources. Connections are accepted, but immediately switched to the persist state (0 byte window), in which the remote side stops sending data and asks to continue every 60-240 seconds. Attempts to…
I'm guessing this may not work, since OP's app sends every 10 seconds and seems to imply that there is some timeout associated with receiving data from the server, but not necessarily a timeout associated with receiving the correct 'SSH-' string needed to move on.
Re: Endlessh: An SSH Tarpit
#94I found that disabling password authentication makes ssh probing mostly stop.
Attackers that are smart enough to detect and avoid pubkey only hosts will probably easily adapt to this program.
Re: Endlessh: An SSH Tarpit
#95Could the return strings be generated by a Deep Learning powered fuzzer?
The return strings could be anything, provided they fall under the max length in the spec. DP fuzz it all you want.
Re: Endlessh: An SSH Tarpit
#96I'm not sure I like this. How secure is it? Anything you put on port 22 is going to be attacked relentlessly. I think I'd rather have OpenSSH handling those attacks than some tarpit program that may or may not have been subjected to the audits and the trial-by-fire that OpenSSH has.
The source code in the article shows that your concerns aren't really.. concerns.
Re: Endlessh: An SSH Tarpit
#97Massively async ssh scanners won't care. They'll time out and move on without being held up at all.
I can confirm that most ssh scanning attempts/scanners I've seen implement timeouts and will usually move on after 30 seconds or so.
Re: Endlessh: An SSH Tarpit
#98This is the Internet equivalent of keeping phone scammers on the line by not just refusing to hang up, but actively interacting with them until they hang up (search YouTube for "tech support scammer trolling" for some entertainment...) That said, I'm a little confused even after reading the linked RFC paragraph; it claims "The primary use of this feature is to allow TCP-wrappers to display an error message before dis…
> actively interacting with them until they hang up
The best stuff is automated. Lenny has been at it for years now.
https://www.reddit.com/r/itslenny/comments/aylq20/lenny_qual...
Re: Endlessh: An SSH Tarpit
#99Wouldn’t cycling over the lines of an ASCII middle finger be more efficient and equally as useful as generating random strings? The middle finger would fit in a few cache lines at most.
Re: Endlessh: An SSH Tarpit
#100Earlier quoted context omitted.
And the second guess would be port 2222, so don't use it for a real ssh server!
I suspect that bots that randomly scan IP addresses for vulnerable hosts don't bother trying anything besides 22. I've been running my sshd on port 622 for a long time and I never get fishy connections (while I'd get at least one a week on port 22). On the other hand a dedicated attacker who really wants to pwn your server will just scan all the ports and figure out what is listening and where. At this point you're b…
Every machine I control has sshd listening on port 222 for that last reason.