Endlessh: An SSH Tarpit • Hacker News Board

Re: Endlessh: An SSH Tarpit

#51

Post by golem14 » Wed, Sep 16, 2020, 4:37 PM UTC

prussian wrote: post #32

k33n wrote: post #23

The tarpit approach is a double-edged sword. Sure, you're keeping some script kiddie's machine locked up (maybe), but you're also keeping socket connections open and wasting resources on the machine they are targeting. A much more efficient approach is using fail2ban and a firewall to just drop traffic from offenders.

You could also do a combined approach with the tarpit + fail2ban parser that could just ban people stuck for longer than x amount of seconds.

In my experience, fail2ban does only help if there is a small number of IP addresses requests come from. I usually observed a trickle of requests from huge number of IP addresses, at most 1-2 request from each IP over the course of days.

tarpit will likely hurt yourself as the system ties up sockets for a long time and you'll run out eventually. You'd have to combine the tarpit with something to limit the number of connections you accept.

IMO, setting up ssh on another port has been useful, especially combined with port knocking. And of course turning off password auth.

Re: Endlessh: An SSH Tarpit

#52

Post by jjeaff » Wed, Sep 16, 2020, 4:42 PM UTC

kebman wrote: post #42

toyg wrote: post #21

Earlier quoted context omitted.

> Running a tar pit is a bit like installing a trap on a bike in order to teach bike thieves a lesson. It's more like approaching a thief and persuading him to steal some bike "just around the corner", then guiding him around endlessly. While he's following you, he's also not stealing anything from anyone, his attention (which is naturally finite) gets drained - even just a little bit - to the benefit of the communit…

Tangent story. Two friends of mine went backpacking to Amsterdam, short pants and all. When they got out of the train in the evening, a friendly guy approached them and asked if they were looking for a hotel. They said yes, so he told them to follow him. Delighted to be greeted in this way, they did. First they went down the regular path up Damrak to get to Leidseplein, but slowly and imperceptibly the streets were g…

People will approach tourists a lot like this in central and south america, but the end game tends to be to take the tourist to an inn or restaurant where they get a commission for taking them.

I've never gone with anyone anywhere but very public spaces. But I actually have found some real gems tucked away off the beaten path this way.

Re: Endlessh: An SSH Tarpit

#53

Post by pnutjam » Wed, Sep 16, 2020, 4:45 PM UTC

protomyth wrote: post #33

pnutjam wrote: post #30

Earlier quoted context omitted.

Don't forget fail2ban or something similar. 2 hour lockout after 4 bad tries does wonders to discourage bots.

Well, if you use certificates, you can immediately ban anyone trying to do password authentication.

True, but having supported an sftp server for other b2b clients to upload data, ssh keys are black magic to too many people. I can't count the hours I've spent trying to explain them, how to generate them and why you should never "show anyone your privates", just your publics.

Re: Endlessh: An SSH Tarpit

#54

Post by geocrasher » Wed, Sep 16, 2020, 4:55 PM UTC

I have to admit that I tried this and it was rather lackluster. Log output:

https://pastebin.com/4FTHRF3f

Not a lot of activity over the time I ran it, and I know that the port gets hit more than that. I had a much better time when I ran a honeypot with Kippo:

https://github.com/desaster/kippo

It was much more useful as it gave me a great list of IP's to block from all my systems ;)

Re: Endlessh: An SSH Tarpit

#55

Post by geocrasher » Wed, Sep 16, 2020, 5:09 PM UTC

mortehu wrote: post #16

seqizz wrote: post #15

I'd rather have a trusted common list of known abusers' IPs. But I think that's harder to maintain.

That's called a DNSBL, and there are many of them, mostly for email spam though. https://www.dnsbl.info/

What I find infuriating is when an admin gets the bright idea to block all connections from IP's that are in mail dnsbl's. It's a great way to alienate people from using your services. I can't remember which company was doing it, but a customers API calls to a vendor failed because the vendor blocked the IP, which was blacklisted somewhere.

Here's the kicker: The server wasn't even used to send mail and hadn't been for a long time. So we had to apply for a delisting from a mail blacklist for a server that didn't send mail so that a customer could use an API.

The admin thought they were being clever, but instead they were just being difficult.

Re: Endlessh: An SSH Tarpit

#56

Post by Freaky » Wed, Sep 16, 2020, 5:21 PM UTC

One I made in async Rust: https://github.com/Freaky/tarssh

I currently have 22 clients stuck it in across three machines. When I started out it was more like a thousand, so seems they've largely adapted.

Re: Endlessh: An SSH Tarpit

#57

Post by dclaw » Wed, Sep 16, 2020, 5:21 PM UTC

Hah, I love endlessh.... been running it for a few years now on one of my digital ocean droplets. Better to fuck with these bots. My personal record was somewhere around 23 days having one stuck.

Re: Endlessh: An SSH Tarpit

#58

Post by tyingq » Wed, Sep 16, 2020, 5:25 PM UTC

jk563 wrote: post #12

DarkWiiPlayer wrote: post #9

Reminds me of the dungeon I built for web crawlers to have fun collecting email addresses at https://darkwiiplayer.com/bot-dungeon xD

Does it only go to level 100?

Nope.

5420 levels seems to be the limit:

This one, right at the limit of 5420, works:

https://darkwiiplayer.com/bot-dungeon/M1Kt80XBcvk4ofn2m2IqRV...

(YMMV, some browsers might have their own url length limitations)

This one, at 5421 levels, breaks:

https://darkwiiplayer.com/bot-dungeon/M1Kt80XBcvk4ofn2m2IqRV...

Re: Endlessh: An SSH Tarpit

#59

Post by jchook » Wed, Sep 16, 2020, 5:39 PM UTC

narrator wrote: post #48

LinuxBender wrote: post #38

Earlier quoted context omitted.

Yes, well, mostly just for entertainment. My sftp server acts in a weird way like a tarpit. Instead of tarpitting or blocking the bots, I create accounts for them with null passwords. I was hoping they might upload something interesting, but no... they just try to get a shell or try to forward ports to other sites, which I do not allow. Some of them have been connecting several times an hour for the past several year…

When I used to run my own MX on a home server, I would have bots connect and try to send mail to @mydomain. They never used the same email or IP and they did it for several years straight. I tried IP blocking, but the IPChains list got so long it started slowing down my server.

This is why folks use techniques like greylisting and why you should almost never use a catch-all mailbox.

Spamhaus usually stops a big chunk of them too.

Re: Endlessh: An SSH Tarpit

#60

Post by jchook » Wed, Sep 16, 2020, 5:42 PM UTC

chromaton wrote: post #43

xoa wrote: post #8

Are tarpits still of use these days? I sort of figured that even modern script mass attackers have gotten professionalized and sophisticated enough that they can deal with trivial timeouts and the like. I could see actual honeypots still being of use for researchers or blue teams at organizations that are real targets, and ML might even open up some interesting new ways to make those more engaging for longer. But a t…

I've successfully used an HTTP tarpit to cut down on registration spam. The attacks were being launched from only a handful of (presumably compromised) hosts. If I blocked them, they'd switch to a different attacking host. But I discovered if I tarpitted them, they'd be slowed down to the point where they weren't a problem any more.

How did it work?