I'm sure this was fun to put together and it seems like it's fun for people to talk about, but you can put this along with fail2ban, port knocking, and nonstandard SSH ports in the back of the attic and just (1) turn off password authentication entirely and (2) put SSH behind WireGuard. Even if you don't do step (2), step (1) eliminates the rationale for all the silly stuff people do to obfuscate their SSH installs.
Endlessh: An SSH Tarpit
41–50 of 107 posts
Re: Endlessh: An SSH Tarpit
#42Earlier quoted context omitted.
For individuals and smaller orgs the easiest and by experience the best practice is to use a certificate (or generated and never to be reused password) for ssh authentication, install server monitoring, and then simply observe if the spam from random drive-by causes enough resource drain that would validate further work. Most likely it won't. Running a tar pit is a bit like installing a trap on a bike in order to tea…
> Running a tar pit is a bit like installing a trap on a bike in order to teach bike thieves a lesson. It's more like approaching a thief and persuading him to steal some bike "just around the corner", then guiding him around endlessly. While he's following you, he's also not stealing anything from anyone, his attention (which is naturally finite) gets drained - even just a little bit - to the benefit of the communit…
Tangent story. Two friends of mine went backpacking to Amsterdam, short pants and all. When they got out of the train in the evening, a friendly guy approached them and asked if they were looking for a hotel. They said yes, so he told them to follow him. Delighted to be greeted in this way, they did.
First they went down the regular path up Damrak to get to Leidseplein, but slowly and imperceptibly the streets were getting narrower and narrower, until they finally reached a dead end. That's when the guy whirled around, flipped out a small pocket knife and wheezed to them, "Gimme all your cash! NOW!"
The guys looked at each other, and then looked at him, and then one of the guys calmly told him, "Look, we're two guys, and you're just one. Even if you get one of us, the other will beat your head in. You can't win this."
The mugger looked puzzled for a moment, but then he retorted, "Ok, give me half your money then, and nobody gets hurt!" Not wanting to be the first guy who got stabbed, they agreed that, "Fine, we'll give you half! But only if you promise to not stab us." And so the deal went down, and they had finally arrived in Amsterdam.
Re: Endlessh: An SSH Tarpit
#43Are tarpits still of use these days? I sort of figured that even modern script mass attackers have gotten professionalized and sophisticated enough that they can deal with trivial timeouts and the like. I could see actual honeypots still being of use for researchers or blue teams at organizations that are real targets, and ML might even open up some interesting new ways to make those more engaging for longer. But a t…
I've successfully used an HTTP tarpit to cut down on registration spam. The attacks were being launched from only a handful of (presumably compromised) hosts. If I blocked them, they'd switch to a different attacking host. But I discovered if I tarpitted them, they'd be slowed down to the point where they weren't a problem any more.
Re: Endlessh: An SSH Tarpit
#44Earlier quoted context omitted.
Don't forget fail2ban or something similar. 2 hour lockout after 4 bad tries does wonders to discourage bots.
Well, if you use certificates, you can immediately ban anyone trying to do password authentication.
Just an obvious protip to test that your cert works before banning password auths. I uh, found out the hard way.
Re: Endlessh: An SSH Tarpit
#45Reminds me of the dungeon I built for web crawlers to have fun collecting email addresses at https://darkwiiplayer.com/bot-dungeon xD
I'm curious what your traffic looks like. Do you have any stats on how long clients spend traversing your dungeon? Which look like crawlers? Do they identify themselves and how so? It'd be awesome to have a stats page!
Re: Endlessh: An SSH Tarpit
#46Earlier quoted context omitted.
Wait, I think I'm an idiot - does disabling password auth entirely prevent openssh from generating a password prompt?
yes
Whoops, silly me / more coffee needed. All my servers have:
PasswordAuthentication no
ChallengeResponseAuthentication no
They all run on a non-standard port, and it's somewhat rare to see more than one unique IP address connection attempt, but every few days you see a few hundred in sequence from a script too dumb to notice.
Re: Endlessh: An SSH Tarpit
#47Earlier quoted context omitted.
> Running a tar pit is a bit like installing a trap on a bike in order to teach bike thieves a lesson. It's more like approaching a thief and persuading him to steal some bike "just around the corner", then guiding him around endlessly. While he's following you, he's also not stealing anything from anyone, his attention (which is naturally finite) gets drained - even just a little bit - to the benefit of the communit…
Tangent story. Two friends of mine went backpacking to Amsterdam, short pants and all. When they got out of the train in the evening, a friendly guy approached them and asked if they were looking for a hotel. They said yes, so he told them to follow him. Delighted to be greeted in this way, they did. First they went down the regular path up Damrak to get to Leidseplein, but slowly and imperceptibly the streets were g…
Lol someone approached me like that in Amsterdam too and offered to guide me somewhere. I figured that this was his plan so I told him I was okay and that I didn’t need his help.
Re: Endlessh: An SSH Tarpit
#48Are tarpits still of use these days? I sort of figured that even modern script mass attackers have gotten professionalized and sophisticated enough that they can deal with trivial timeouts and the like. I could see actual honeypots still being of use for researchers or blue teams at organizations that are real targets, and ML might even open up some interesting new ways to make those more engaging for longer. But a t…
Yes, well, mostly just for entertainment. My sftp server acts in a weird way like a tarpit. Instead of tarpitting or blocking the bots, I create accounts for them with null passwords. I was hoping they might upload something interesting, but no... they just try to get a shell or try to forward ports to other sites, which I do not allow. Some of them have been connecting several times an hour for the past several year…
When I used to run my own MX on a home server, I would have bots connect and try to send mail to @mydomain. They never used the same email or IP and they did it for several years straight. I tried IP blocking, but the IPChains list got so long it started slowing down my server.
Re: Endlessh: An SSH Tarpit
#49Are tarpits still of use these days? I sort of figured that even modern script mass attackers have gotten professionalized and sophisticated enough that they can deal with trivial timeouts and the like. I could see actual honeypots still being of use for researchers or blue teams at organizations that are real targets, and ML might even open up some interesting new ways to make those more engaging for longer. But a t…
Yes, well, mostly just for entertainment. My sftp server acts in a weird way like a tarpit. Instead of tarpitting or blocking the bots, I create accounts for them with null passwords. I was hoping they might upload something interesting, but no... they just try to get a shell or try to forward ports to other sites, which I do not allow. Some of them have been connecting several times an hour for the past several year…
If you rewrite those portforward destinations to your own server, do they get stuck in an endless loop?
Re: Endlessh: An SSH Tarpit
#50Earlier quoted context omitted.
Well, if you use certificates, you can immediately ban anyone trying to do password authentication.
Just an obvious protip to test that your cert works before banning password auths. I uh, found out the hard way.
Yeah, cannot say I've never done that.
Test then Ban.