Endlessh: An SSH Tarpit • Hacker News Board

Re: Endlessh: An SSH Tarpit

#101

Post by boring_twenties » Thu, Sep 17, 2020, 8:33 PM UTC

pnutjam wrote: post #100

boring_twenties wrote: post #87

Earlier quoted context omitted.

I don't like it because it opens up the possibility of someone on the same network as me locking me out of my own server. Sure, it's unlikely, but I don't see what I'd be gaining using fail2ban in the first place. I don't leave password authentication enabled, of course. Log spam is a bit annoying, but at the end of the day, who cares? Even with the ongoing attempts, my authlog is like 300K uncompressed today and 60-…

If your passing through a NAT, you can whitelist your own IP. something like: fail2ban-client set addignoreip x.x.x.x or fail2ban-client set addignoreregex hostname.com

Sure. But why? We're talking about 1MB to keep a week's worth of logs. It's just not worth even a minor hassle, or the most remote possibility of failure.

Re: Endlessh: An SSH Tarpit

#102

Post by pnutjam » Thu, Sep 17, 2020, 8:57 PM UTC

boring_twenties wrote: post #101

pnutjam wrote: post #100

Earlier quoted context omitted.

If your passing through a NAT, you can whitelist your own IP. something like: fail2ban-client set addignoreip x.x.x.x or fail2ban-client set addignoreregex hostname.com

Sure. But why? We're talking about 1MB to keep a week's worth of logs. It's just not worth even a minor hassle, or the most remote possibility of failure.

It's not about logs, it's about defense layers.

Re: Endlessh: An SSH Tarpit

#103

Post by jchook » Thu, Sep 17, 2020, 11:43 PM UTC

toxik wrote: post #65

jchook wrote: post #59

Earlier quoted context omitted.

This is why folks use techniques like greylisting and why you should almost never use a catch-all mailbox. Spamhaus usually stops a big chunk of them too.

Hard disagree on catch all. A catch all allows you to trace who gave your address to spammers, and then to bin all email to that address.

Except then spammers who send to [huge list of words]@your-domain.com all go to your inbox. It's much safer to use a regex pattern or generate forwarding emails ad hoc.

Please contact me at f7m4 {at} proxyto.me if you have any interest in beta-testing an app that does this exact thing.

Re: Endlessh: An SSH Tarpit

#104

Post by earthboundkid » Fri, Sep 18, 2020, 12:04 AM UTC

ryankrage77 wrote: post #97

earthboundkid wrote: post #88

https://github.com/carlmjohnson/heffalump

This seems like it would use a lot of bandwidth?

Oh, it’s a terrible idea. It’s basically a practical joke.

Re: Endlessh: An SSH Tarpit

#105

Post by DarkWiiPlayer » Fri, Sep 18, 2020, 12:13 PM UTC

rootlocus wrote: post #26

DarkWiiPlayer wrote: post #9

Reminds me of the dungeon I built for web crawlers to have fun collecting email addresses at https://darkwiiplayer.com/bot-dungeon xD

Do you have any statistics? What's the deepest level any bot has gotten?

> Do you have any statistics?

Not really, no. If I ever rebuild my website, I will probably add some stats though :D

Re: Endlessh: An SSH Tarpit

#106

Post by teddyh » Sat, Sep 19, 2020, 7:28 PM UTC

toyg wrote: post #70

milesvp wrote: post #64

Earlier quoted context omitted.

A friend and I took a day trip to Morocco many years ago while backpacking through Spain and experienced this. A local guide approached us who came across as pretty legit and had a driver. We had a good time being shown around to different stores and it was pretty clear that he was getting a kickback from the places we went. Had some nice mint tea, and a pretty good meal later. There was a slightly dark time in the m…

Morocco has a very mean and torture-happy secret police, and tourists are one of their main sources of income, so it’s very unlikely that anything particularly bad will ever happen to you, the risk for perps is too high. Cash, though... I was basically extorted by some guys with aggressive monkeys in the middle of Marrakech.

> Morocco has a very mean and torture-happy secret police, and tourists are one of their main sources of income

I initially interpreted that sentence differently than how you probably intended it.

Re: Endlessh: An SSH Tarpit

#107

Post by teddyh » Sat, Sep 19, 2020, 7:32 PM UTC

tptacek wrote: post #41

I'm sure this was fun to put together and it seems like it's fun for people to talk about, but you can put this along with fail2ban, port knocking, and nonstandard SSH ports in the back of the attic and just (1) turn off password authentication entirely and (2) put SSH behind WireGuard. Even if you don't do step (2), step (1) eliminates the rationale for all the silly stuff people do to obfuscate their SSH installs.

I you put it behind WireGuard, why use SSH? Why not simply use telnet instead? And use FTP for file transfers.