Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Endlessh: An SSH Tarpit

github.com

Post reply on HN
Print view View original

61–70 of 107 posts

Re: Endlessh: An SSH Tarpit

#61

Post by chromaton »

jchook wrote: post #60
chromaton wrote: post #43

Earlier quoted context omitted.

I've successfully used an HTTP tarpit to cut down on registration spam. The attacks were being launched from only a handful of (presumably compromised) hosts. If I blocked them, they'd switch to a different attacking host. But I discovered if I tarpitted them, they'd be slowed down to the point where they weren't a problem any more.

How did it work?

Something like:

  if(IP==attackerIP) {
    for 10000 times
       write random byte
       sleep 10 seconds
  }

Re: Endlessh: An SSH Tarpit

#62

Post by efreak »

dawnerd wrote: post #44
protomyth wrote: post #33

Earlier quoted context omitted.

Well, if you use certificates, you can immediately ban anyone trying to do password authentication.

Just an obvious protip to test that your cert works before banning password auths. I uh, found out the hard way.

I never had an issue with authentication. My issue was a typo in sudoers (I allowed a user to view syslog, iirc, and had a semicolon instead of a colon) that prevented me from using sudo, as only my primary user was allowed to log in via ssh. Fortunately cloud vps still has vnc login, and I actually had a root password. Now I use a root shell to edit sudoers, so I can test it before dropping root.

Re: Endlessh: An SSH Tarpit

#63

Post by efreak »

MCOfficer wrote: post #40
kmbfjr wrote: post #35

Earlier quoted context omitted.

Your concern is well founded, but what are you going to use that doesn't end up touching libraries written in...C? We're a long way from "Smashing the Stack", people are aware of mitigation and the care that needs to be taken, precautions have been made inside operating systems and compilers.

I take the bait... rust.

Looks like it's been done: https://news.ycombinator.com/item?id=24494871

Re: Endlessh: An SSH Tarpit

#64

Post by milesvp »

jjeaff wrote: post #52
kebman wrote: post #42

Earlier quoted context omitted.

Tangent story. Two friends of mine went backpacking to Amsterdam, short pants and all. When they got out of the train in the evening, a friendly guy approached them and asked if they were looking for a hotel. They said yes, so he told them to follow him. Delighted to be greeted in this way, they did. First they went down the regular path up Damrak to get to Leidseplein, but slowly and imperceptibly the streets were g…

People will approach tourists a lot like this in central and south america, but the end game tends to be to take the tourist to an inn or restaurant where they get a commission for taking them. I've never gone with anyone anywhere but very public spaces. But I actually have found some real gems tucked away off the beaten path this way.

A friend and I took a day trip to Morocco many years ago while backpacking through Spain and experienced this. A local guide approached us who came across as pretty legit and had a driver. We had a good time being shown around to different stores and it was pretty clear that he was getting a kickback from the places we went. Had some nice mint tea, and a pretty good meal later.

There was a slightly dark time in the middle though, where my friend and I were sure we were going to be mugged and left for dead when we were driving further and further from the city. I've never experienced anything quite like it before or since. We both looked at each other, and in an instant with a single expression we were both able to convey that "I love you and we're going to die". We were totally relieved when it turned out they just wanted to show a scenic view by the sea, while showing us a lot of very rich mansions along the way.

Was totally surreal, though, and I'm not sure how lucky we were.

Re: Endlessh: An SSH Tarpit

#65

Post by toxik »

jchook wrote: post #59
narrator wrote: post #48

Earlier quoted context omitted.

When I used to run my own MX on a home server, I would have bots connect and try to send mail to @mydomain. They never used the same email or IP and they did it for several years straight. I tried IP blocking, but the IPChains list got so long it started slowing down my server.

This is why folks use techniques like greylisting and why you should almost never use a catch-all mailbox. Spamhaus usually stops a big chunk of them too.

Hard disagree on catch all. A catch all allows you to trace who gave your address to spammers, and then to bin all email to that address.

Re: Endlessh: An SSH Tarpit

#66

Post by toxik »

narrator wrote: post #48
LinuxBender wrote: post #38

Earlier quoted context omitted.

Yes, well, mostly just for entertainment. My sftp server acts in a weird way like a tarpit. Instead of tarpitting or blocking the bots, I create accounts for them with null passwords. I was hoping they might upload something interesting, but no... they just try to get a shell or try to forward ports to other sites, which I do not allow. Some of them have been connecting several times an hour for the past several year…

When I used to run my own MX on a home server, I would have bots connect and try to send mail to @mydomain. They never used the same email or IP and they did it for several years straight. I tried IP blocking, but the IPChains list got so long it started slowing down my server.

I had a similar issue, attempts to brute my server every minute of every day. I aggregated stats on the IP’s, basically every single one was Chinese. I blocked most of China’s IP ranges and it’s now as quite as it was in 2005.

Re: Endlessh: An SSH Tarpit

#67

Post by Drdrdrq »

tptacek wrote: post #41

I'm sure this was fun to put together and it seems like it's fun for people to talk about, but you can put this along with fail2ban, port knocking, and nonstandard SSH ports in the back of the attic and just (1) turn off password authentication entirely and (2) put SSH behind WireGuard. Even if you don't do step (2), step (1) eliminates the rationale for all the silly stuff people do to obfuscate their SSH installs.

Could you elaborate on WireGuard part? Do you mean that users must first VPN, and only then can SSH, or something else?

Re: Endlessh: An SSH Tarpit

#68

Post by graton »

kebman wrote: post #42
toyg wrote: post #21

Earlier quoted context omitted.

> Running a tar pit is a bit like installing a trap on a bike in order to teach bike thieves a lesson. It's more like approaching a thief and persuading him to steal some bike "just around the corner", then guiding him around endlessly. While he's following you, he's also not stealing anything from anyone, his attention (which is naturally finite) gets drained - even just a little bit - to the benefit of the communit…

Tangent story. Two friends of mine went backpacking to Amsterdam, short pants and all. When they got out of the train in the evening, a friendly guy approached them and asked if they were looking for a hotel. They said yes, so he told them to follow him. Delighted to be greeted in this way, they did. First they went down the regular path up Damrak to get to Leidseplein, but slowly and imperceptibly the streets were g…

Makes me think of one of my personal rules when traveling. If I am needing help, I don't take it from someone who approaches me. I just say, no thank you. If I need help, I pick someone randomly and ask for help. The likelihood that they are a criminal is much less compared to someone who approaches me.

Re: Endlessh: An SSH Tarpit

#69

Post by car »

kebman wrote: post #42
toyg wrote: post #21

Earlier quoted context omitted.

> Running a tar pit is a bit like installing a trap on a bike in order to teach bike thieves a lesson. It's more like approaching a thief and persuading him to steal some bike "just around the corner", then guiding him around endlessly. While he's following you, he's also not stealing anything from anyone, his attention (which is naturally finite) gets drained - even just a little bit - to the benefit of the communit…

Tangent story. Two friends of mine went backpacking to Amsterdam, short pants and all. When they got out of the train in the evening, a friendly guy approached them and asked if they were looking for a hotel. They said yes, so he told them to follow him. Delighted to be greeted in this way, they did. First they went down the regular path up Damrak to get to Leidseplein, but slowly and imperceptibly the streets were g…

Tangent on tangent. An aquaintance visited Morroco, and was befriended by a young local, his guide for two weeks. On the last day, he bought a $3000 rug from a store owner relative of the guide. Suffice it to say, said rug never shipped.

Re: Endlessh: An SSH Tarpit

#70

Post by toyg »

milesvp wrote: post #64
jjeaff wrote: post #52

Earlier quoted context omitted.

People will approach tourists a lot like this in central and south america, but the end game tends to be to take the tourist to an inn or restaurant where they get a commission for taking them. I've never gone with anyone anywhere but very public spaces. But I actually have found some real gems tucked away off the beaten path this way.

A friend and I took a day trip to Morocco many years ago while backpacking through Spain and experienced this. A local guide approached us who came across as pretty legit and had a driver. We had a good time being shown around to different stores and it was pretty clear that he was getting a kickback from the places we went. Had some nice mint tea, and a pretty good meal later. There was a slightly dark time in the m…

Morocco has a very mean and torture-happy secret police, and tourists are one of their main sources of income, so it’s very unlikely that anything particularly bad will ever happen to you, the risk for perps is too high. Cash, though... I was basically extorted by some guys with aggressive monkeys in the middle of Marrakech.
Post reply on HN