Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Endlessh: An SSH Tarpit

github.com

Post reply on HN
Print view View original

31–40 of 107 posts

Re: Endlessh: An SSH Tarpit

#31

Post by mtlynch »

k33n wrote: post #23

The tarpit approach is a double-edged sword. Sure, you're keeping some script kiddie's machine locked up (maybe), but you're also keeping socket connections open and wasting resources on the machine they are targeting. A much more efficient approach is using fail2ban and a firewall to just drop traffic from offenders.

Tarpits aren't really a defense mechanism. They're meant to waste attackers' time and study their techniques, making attacks more expensive.

It's sort of like those YouTube channels where they waste phone scammers' time in an entertaining way. [0] Obviously, the easiest thing for the callee to do is hang up the phone, but their goal is to make phone scams less profitable.

[0] https://en.wikipedia.org/wiki/Jim_Browning_(YouTuber)

Re: Endlessh: An SSH Tarpit

#32

Post by prussian »

k33n wrote: post #23

The tarpit approach is a double-edged sword. Sure, you're keeping some script kiddie's machine locked up (maybe), but you're also keeping socket connections open and wasting resources on the machine they are targeting. A much more efficient approach is using fail2ban and a firewall to just drop traffic from offenders.

You could also do a combined approach with the tarpit + fail2ban parser that could just ban people stuck for longer than x amount of seconds.

Re: Endlessh: An SSH Tarpit

#33

Post by protomyth »

pnutjam wrote: post #30
xoa wrote: post #8

Are tarpits still of use these days? I sort of figured that even modern script mass attackers have gotten professionalized and sophisticated enough that they can deal with trivial timeouts and the like. I could see actual honeypots still being of use for researchers or blue teams at organizations that are real targets, and ML might even open up some interesting new ways to make those more engaging for longer. But a t…

Don't forget fail2ban or something similar. 2 hour lockout after 4 bad tries does wonders to discourage bots.

Well, if you use certificates, you can immediately ban anyone trying to do password authentication.

Re: Endlessh: An SSH Tarpit

#34

Post by creeble »

verroq wrote: post #20

This would have been fun to put onto production machines. We had a botnet that was running ssh bruteforce with 10s requests per second with unique IPs. It stopped after we disabled password auth.

Wait, I think I'm an idiot - does disabling password auth entirely prevent openssh from generating a password prompt?

Re: Endlessh: An SSH Tarpit

#35

Post by kmbfjr »

nickcw wrote: post #2

Great idea! I'm not sure we should be writing new network connected daemons in C though.

Your concern is well founded, but what are you going to use that doesn't end up touching libraries written in...C?

We're a long way from "Smashing the Stack", people are aware of mitigation and the care that needs to be taken, precautions have been made inside operating systems and compilers.

Re: Endlessh: An SSH Tarpit

#36

Post by ed25519FUUU »

toyg wrote: post #21
belorn wrote: post #18

Earlier quoted context omitted.

For individuals and smaller orgs the easiest and by experience the best practice is to use a certificate (or generated and never to be reused password) for ssh authentication, install server monitoring, and then simply observe if the spam from random drive-by causes enough resource drain that would validate further work. Most likely it won't. Running a tar pit is a bit like installing a trap on a bike in order to tea…

> Running a tar pit is a bit like installing a trap on a bike in order to teach bike thieves a lesson. It's more like approaching a thief and persuading him to steal some bike "just around the corner", then guiding him around endlessly. While he's following you, he's also not stealing anything from anyone, his attention (which is naturally finite) gets drained - even just a little bit - to the benefit of the communit…

It sounds like you’re both trapped in this scenario.

Re: Endlessh: An SSH Tarpit

#38

Post by LinuxBender »

xoa wrote: post #8

Are tarpits still of use these days? I sort of figured that even modern script mass attackers have gotten professionalized and sophisticated enough that they can deal with trivial timeouts and the like. I could see actual honeypots still being of use for researchers or blue teams at organizations that are real targets, and ML might even open up some interesting new ways to make those more engaging for longer. But a t…

Yes, well, mostly just for entertainment. My sftp server acts in a weird way like a tarpit. Instead of tarpitting or blocking the bots, I create accounts for them with null passwords. I was hoping they might upload something interesting, but no... they just try to get a shell or try to forward ports to other sites, which I do not allow. Some of them have been connecting several times an hour for the past several years.

Re: Endlessh: An SSH Tarpit

#39

Post by VWWHFSfQ »

creeble wrote: post #34
verroq wrote: post #20

This would have been fun to put onto production machines. We had a botnet that was running ssh bruteforce with 10s requests per second with unique IPs. It stopped after we disabled password auth.

Wait, I think I'm an idiot - does disabling password auth entirely prevent openssh from generating a password prompt?

yes

Re: Endlessh: An SSH Tarpit

#40

Post by MCOfficer »

kmbfjr wrote: post #35
nickcw wrote: post #2

Great idea! I'm not sure we should be writing new network connected daemons in C though.

Your concern is well founded, but what are you going to use that doesn't end up touching libraries written in...C? We're a long way from "Smashing the Stack", people are aware of mitigation and the care that needs to be taken, precautions have been made inside operating systems and compilers.

I take the bait... rust.
Post reply on HN