Awesome! Love reading hacks like these.
Endlessh: An SSH Tarpit
11–20 of 118 posts
Re: Endlessh: An SSH Tarpit
#12I'm not sure I like this. How secure is it? Anything you put on port 22 is going to be attacked relentlessly. I think I'd rather have OpenSSH handling those attacks than some tarpit program that may or may not have been subjected to the audits and the trial-by-fire that OpenSSH has.
A program like this has vastly less attack surface than a full SSH protocol implementation. In particular, it doesn't support the part of the SSH protocol that allows executing commands on a remote host. So the only way this will be less secure than OpenSSH is if there's some memory unsafety or a leak of some kind.
almost all of the SSH protocol isn't exposed until you authenticate, and in the vast majority of setups that means you get a shell to execute commands with anyways, so while still important, the key problems are with pre-auth security.
Re: Endlessh: An SSH Tarpit
#13I'm not sure I like this. How secure is it? Anything you put on port 22 is going to be attacked relentlessly. I think I'd rather have OpenSSH handling those attacks than some tarpit program that may or may not have been subjected to the audits and the trial-by-fire that OpenSSH has.
I'm not sure I catch your drift. It seems like the point is that it doesn't actually implement the SSH protocol- it just exploits the fact that a real SSH server is perfectly within its rights to send any data it wants to before a version string. (And on top of that, it looks like it doesn't even read anything from the socket?)
Is there something I'm missing here (probably related to poll(2)) that could cause this to be insecure?
Re: Endlessh: An SSH Tarpit
#14I must not be understanding something...
Does this still allow whitelisted machines to connect, or is this just a troll thing to do?
Re: Endlessh: An SSH Tarpit
#15[deleted]
Re: Endlessh: An SSH Tarpit
#16I haven't used it in years, but Tom Liston's "Labrea" tarpit is an interesting take on this concept: https://github.com/Hirato/LaBrea It listens in your unused IP space and both tar-pits scanners and creates actionable intelligence about scans against your hosts.
I love the fake arp responses, that's a brilliant way so you can run this on any machine (doesn't have to be a router) and not worry about managing new hosts (no black/whitelist to manage of which IPs are unused).
Re: Endlessh: An SSH Tarpit
#17I must not be understanding something... Does this still allow whitelisted machines to connect, or is this just a troll thing to do?
Presumably legitimate access would be on port 22, whereas only bots would hit 2222.
Re: Endlessh: An SSH Tarpit
#18I must not be understanding something... Does this still allow whitelisted machines to connect, or is this just a troll thing to do?
The idea is that you run your real SSH server somewhere else, like on a different port. If you scroll down a little (like, skim over the article) you see some example code that is basically the entire server. It's just a few lines of code, there is no real SSH implementation in this thing. And that's the whole idea: it can't really be hacked and it thwarts attackers.
Re: Endlessh: An SSH Tarpit
#19I must not be understanding something... Does this still allow whitelisted machines to connect, or is this just a troll thing to do?
This will not allow any machine to connect on the port it's listening on.
The idea is that you set Endlessh on your server's port 22 (standard SSH port), then configure "actual" SSH to listen on a different (randomly selected) port. You connect to that port to get stuff done. Bots that troll for connections on port 22 will get stuck on port 22.
Re: Endlessh: An SSH Tarpit
#20I must not be understanding something... Does this still allow whitelisted machines to connect, or is this just a troll thing to do?
Presumably legitimate access would be on port 22, whereas only bots would hit 2222.
almost, but backwards. The bots all know port 22. Only you know which random other port is the real ssh port.