Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Endlessh: An SSH Tarpit

github.com

Post reply on HN
Print view View original

81–90 of 107 posts

Re: Endlessh: An SSH Tarpit

#81

Post by tomcam »

kebman wrote: post #42
toyg wrote: post #21

Earlier quoted context omitted.

> Running a tar pit is a bit like installing a trap on a bike in order to teach bike thieves a lesson. It's more like approaching a thief and persuading him to steal some bike "just around the corner", then guiding him around endlessly. While he's following you, he's also not stealing anything from anyone, his attention (which is naturally finite) gets drained - even just a little bit - to the benefit of the communit…

Tangent story. Two friends of mine went backpacking to Amsterdam, short pants and all. When they got out of the train in the evening, a friendly guy approached them and asked if they were looking for a hotel. They said yes, so he told them to follow him. Delighted to be greeted in this way, they did. First they went down the regular path up Damrak to get to Leidseplein, but slowly and imperceptibly the streets were g…

Fun.

Wouldn't end that way with me and my friends.

Re: Endlessh: An SSH Tarpit

#82

Post by jooize »

pnutjam wrote: post #53
protomyth wrote: post #33

Earlier quoted context omitted.

Well, if you use certificates, you can immediately ban anyone trying to do password authentication.

True, but having supported an sftp server for other b2b clients to upload data, ssh keys are black magic to too many people. I can't count the hours I've spent trying to explain them, how to generate them and why you should never "show anyone your privates", just your publics.

It would be more obvious if the private key files were named “id_ed25519.private”.

Why not make it “identity.ed25519.private.sshkey” and default to “20200916{,T224400Z}.ed25519.{private,public}.sshkey”?

Re: Endlessh: An SSH Tarpit

#83

Post by pbhjpbhj »

spc476 wrote: post #78
xoa wrote: post #8

Are tarpits still of use these days? I sort of figured that even modern script mass attackers have gotten professionalized and sophisticated enough that they can deal with trivial timeouts and the like. I could see actual honeypots still being of use for researchers or blue teams at organizations that are real targets, and ML might even open up some interesting new ways to make those more engaging for longer. But a t…

About 15 years ago, I ran a tarpit at my then current job (small ISP for commercial clients and web hosting) that tarpitted all TCP traffic on unused IP blocks. It did slow down network scans and had I gotten around to it, I could have probably set up some way of automatically blocking the IP addresses hitting the tarpit (as no legitimate traffic should hit it).

fail2ban would be the go to solution for blocking IP address used in failed port access attempts.

Re: Endlessh: An SSH Tarpit

#84

Post by pbhjpbhj »

Symbiote wrote: post #72
efreak wrote: post #62

Earlier quoted context omitted.

I never had an issue with authentication. My issue was a typo in sudoers (I allowed a user to view syslog, iirc, and had a semicolon instead of a colon) that prevented me from using sudo, as only my primary user was allowed to log in via ssh. Fortunately cloud vps still has vnc login, and I actually had a root password. Now I use a root shell to edit sudoers, so I can test it before dropping root.

You should use "visudo", which opens the file in the default editor, then validates it before saving.

But make sure to change the default editor to something sane first. (* ducks *)

:q!dammitwtf

Re: Endlessh: An SSH Tarpit

#85

Post by pvg »

tptacek wrote: post #73
Drdrdrq wrote: post #67

Earlier quoted context omitted.

Could you elaborate on WireGuard part? Do you mean that users must first VPN, and only then can SSH, or something else?

Yes. This is how SSH access to prod works in most large companies: you have to be behind the VPN to get it.

You know this but I'm just throwing it in for people who don't and aren't working on large company things:

You can give yourself a WireGuard-powered, Single Sign-on, secure overlay network between, say, your phone, your laptop, a DO droplet and an AWS instance near-instantly and for (currently) free with tailscale.

By 'near-instantly' I mean it takes almost no effort to set up. It takes me longer to get my dotfiles right on a new host.

Re: Endlessh: An SSH Tarpit

#86

Post by ropable »

jjeaff wrote: post #52
kebman wrote: post #42

Earlier quoted context omitted.

Tangent story. Two friends of mine went backpacking to Amsterdam, short pants and all. When they got out of the train in the evening, a friendly guy approached them and asked if they were looking for a hotel. They said yes, so he told them to follow him. Delighted to be greeted in this way, they did. First they went down the regular path up Damrak to get to Leidseplein, but slowly and imperceptibly the streets were g…

People will approach tourists a lot like this in central and south america, but the end game tends to be to take the tourist to an inn or restaurant where they get a commission for taking them. I've never gone with anyone anywhere but very public spaces. But I actually have found some real gems tucked away off the beaten path this way.

Spouse and I got hooked like this when we visited Beijing some years ago. We could actually tell what was going on, but our "guide" was a friendly university-aged girl who (at our request) took us to a couple of local art galleries and a wonderful restaurant. She may have gotten a commission and definitely a good meal out of it, but we actually had a fine experience.

Re: Endlessh: An SSH Tarpit

#87

Post by boring_twenties »

pnutjam wrote: post #30
xoa wrote: post #8

Are tarpits still of use these days? I sort of figured that even modern script mass attackers have gotten professionalized and sophisticated enough that they can deal with trivial timeouts and the like. I could see actual honeypots still being of use for researchers or blue teams at organizations that are real targets, and ML might even open up some interesting new ways to make those more engaging for longer. But a t…

Don't forget fail2ban or something similar. 2 hour lockout after 4 bad tries does wonders to discourage bots.

I don't like it because it opens up the possibility of someone on the same network as me locking me out of my own server.

Sure, it's unlikely, but I don't see what I'd be gaining using fail2ban in the first place. I don't leave password authentication enabled, of course.

Log spam is a bit annoying, but at the end of the day, who cares? Even with the ongoing attempts, my authlog is like 300K uncompressed today and 60-120K per day gzipped. Whatever.

If I cared about that I would prefer to just block Chinese IP ranges outright.

Re: Endlessh: An SSH Tarpit

#89

Post by b112 »

toxik wrote: post #65
jchook wrote: post #59

Earlier quoted context omitted.

This is why folks use techniques like greylisting and why you should almost never use a catch-all mailbox. Spamhaus usually stops a big chunk of them too.

Hard disagree on catch all. A catch all allows you to trace who gave your address to spammers, and then to bin all email to that address.

You don't need a catch all for that, just give unique email addresses to each, and edit /etc/aliases.

NOTE: a few bits of info here, although someone mentioning ipchains means their comment is from an older time of course:

- use ipset for large sets of blocked IP addresses. That's what it's for, and it works well without slowdown, even on massive sets

- http://www.ipdeny.com/ipblocks/data/aggregated

This is a nice list of IP addresses broken down by region. Handy do download weekly, or monthly, and then dump into ipset.

- firehol is also a nice list to use, eg:

https://raw.githubusercontent.com/ktsaou/blocklist-ipsets/ma...

Re: Endlessh: An SSH Tarpit

#90

Post by tptacek »

pvg wrote: post #85
tptacek wrote: post #73

Earlier quoted context omitted.

Yes. This is how SSH access to prod works in most large companies: you have to be behind the VPN to get it.

You know this but I'm just throwing it in for people who don't and aren't working on large company things: You can give yourself a WireGuard-powered, Single Sign-on, secure overlay network between, say, your phone, your laptop, a DO droplet and an AWS instance near-instantly and for (currently) free with tailscale. By 'near-instantly' I mean it takes almost no effort to set up. It takes me longer to get my dotfiles r…

It is disgusting how good Tailscale is. I mean that I am literally welling up with disgust thinking about it.
Post reply on HN