Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Endlessh: An SSH Tarpit

nullprogram.com

Post reply on HN
Print view View original

111–118 of 118 posts

Re: Endlessh: An SSH Tarpit

#111

Post by 0db532a0 »

fxfan wrote: post #92
LinuxBender wrote: post #28

Earlier quoted context omitted.

That would be easy to do with an iptables DNAT rule. You can take a large set of ports and forward them to this daemon. iptables -t nat -I PREROUTING -m tcp -p tcp --dport 1:79 -j DNAT --to-destination x.x.x.x:2222 iptables -t nat -I PREROUTING -m tcp -p tcp --dport 81:442 -j DNAT --to-destination x.x.x.x:2222 ...etc Just remember to open those same ports in the INPUT rules. If you get DDoS, then also create NOTRACK…

You truly sound like a bender. Is there a quick start to iptables somewhere? Is iptables the defacto network tool? And can one prevent ddos using iptables?

iptables is a firewall/NAT interface. nftables is newer and easier to learn, at least to me. You might want to get into that instead of iptables.

Re: Endlessh: An SSH Tarpit

#112

Post by HocusLocus »

I opened up port 22 once so that it connected (without crypto) and issued the phrase,

YOU ARE STANDING AT THE END OF A ROAD BEFORE A SMALL BRICK BUILDING. AROUND YOU IS A FOREST. A SMALL STREAM FLOWS OUT OF THE BUILDING AND DOWN A GULLY.

>

and if they typed in something it would continue to play the game. After hundreds of thousands of automated SSH worm probes over several months, an actual human did connect and play the game for a few minutes! But even this triumph was short lived, they did not even play it to the end to see if something interesting might be unlocked (it would have been an invitation to contact my email address).

Re: Endlessh: An SSH Tarpit

#114

Post by LinuxBender »

dfox wrote: post #104
LinuxBender wrote: post #2

I like this! It's tiny, simple, yet effective. 2019-03-22T19:54:06.303Z ACCEPT host=::ffff:196.52.43.xx port=50327 fd=4 n=1/4096 2019-03-22T19:54:38.838Z CLOSE host=::ffff:196.52.43.xx port=50327 fd=4 time=32.535 bytes=199 2019-03-22T19:57:12.008Z ACCEPT host=::ffff:141.98.81.xx port=53646 fd=4 n=1/4096 2019-03-22T19:57:21.118Z CLOSE host=::ffff:141.98.81.xx port=53646 fd=4 time=9.110 bytes=30 The 141 bot never stays…

Do you realize that the thing does not process any attacker controlled input and thus all the hardening is completely pointless exercise?

If it opens a socket, it gets hardening. It's just a best practice I follow. Code can change. Subtle changes can lead to gaps, so I wrap that rascal regardless.

Re: Endlessh: An SSH Tarpit

#115

Post by LinuxBender »

fxfan wrote: post #92
LinuxBender wrote: post #28

Earlier quoted context omitted.

That would be easy to do with an iptables DNAT rule. You can take a large set of ports and forward them to this daemon. iptables -t nat -I PREROUTING -m tcp -p tcp --dport 1:79 -j DNAT --to-destination x.x.x.x:2222 iptables -t nat -I PREROUTING -m tcp -p tcp --dport 81:442 -j DNAT --to-destination x.x.x.x:2222 ...etc Just remember to open those same ports in the INPUT rules. If you get DDoS, then also create NOTRACK…

You truly sound like a bender. Is there a quick start to iptables somewhere? Is iptables the defacto network tool? And can one prevent ddos using iptables?

> And can one prevent ddos using iptables?

No, but you can minimize the impact or effectiveness of the attack. This is a long topic however. Probably better suited to a blog post or a youtube video.

Re: Endlessh: An SSH Tarpit

#116

Post by LinuxBender »

LinuxBender wrote: post #2

I like this! It's tiny, simple, yet effective. 2019-03-22T19:54:06.303Z ACCEPT host=::ffff:196.52.43.xx port=50327 fd=4 n=1/4096 2019-03-22T19:54:38.838Z CLOSE host=::ffff:196.52.43.xx port=50327 fd=4 time=32.535 bytes=199 2019-03-22T19:57:12.008Z ACCEPT host=::ffff:141.98.81.xx port=53646 fd=4 n=1/4096 2019-03-22T19:57:21.118Z CLOSE host=::ffff:141.98.81.xx port=53646 fd=4 time=9.110 bytes=30 The 141 bot never stays…

I've been running this for a couple days now. In summary, about 85% of the bots give up in 5 to 30 seconds. The remainder of them will remain stuck anywhere from 700 to 9000 seconds. It is at least interesting to see how bots have evolved.

Re: Endlessh: An SSH Tarpit

#117

Post by VvR-Ox »

JohnFen wrote: post #61
tyingq wrote: post #40

Earlier quoted context omitted.

They may be the same type of person that would launch a ddos, for example.

I'm not concerned about this, personally. On my home server, there are only two ports open to the internet -- one for my SSH server, and one for my VPN server. Both of those are running on nonstandard ports. In order to DDOS me, an attacker has to find those ports, which would require a comprehensive scan (increasing the chances that they'll get blocked by my ISP or detected by my antiscan monitor) or a huge amount o…

You can change your ports but it won't prevent "Eve" from scanning for those as you mention yourself. I think this belongs to the realm of "security through obscurity" tactics and won't be safe in the long run.

I can prevent being blocked by your ISP by adjusting the timings etc. of my scripts.

I think it's far more important to take a look at the supported key exchange algorithms etc.

Re: Endlessh: An SSH Tarpit

#118

Post by JohnFen »

VvR-Ox wrote: post #117
JohnFen wrote: post #61

Earlier quoted context omitted.

I'm not concerned about this, personally. On my home server, there are only two ports open to the internet -- one for my SSH server, and one for my VPN server. Both of those are running on nonstandard ports. In order to DDOS me, an attacker has to find those ports, which would require a comprehensive scan (increasing the chances that they'll get blocked by my ISP or detected by my antiscan monitor) or a huge amount o…

You can change your ports but it won't prevent "Eve" from scanning for those as you mention yourself. I think this belongs to the realm of "security through obscurity" tactics and won't be safe in the long run. I can prevent being blocked by your ISP by adjusting the timings etc. of my scripts. I think it's far more important to take a look at the supported key exchange algorithms etc.

You are correct. This falls into the cost/benefit calculation of security. A DDOS attack on my home network would be annoying, but not devastating, so I'm willing to accept a little vulnerability to them in exchange for other benefits.

> I can prevent being blocked by your ISP by adjusting the timings etc. of my scripts.

But that won't let you escape detection by my system's own defenses. Well, you could if you slowed down the scan enough -- but "enough" is pretty darned slow.

Post reply on HN