Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Endlessh: An SSH Tarpit

github.com

Post reply on HN
Print view View original

71–80 of 107 posts

Re: Endlessh: An SSH Tarpit

#71

Post by Symbiote »

graton wrote: post #68
kebman wrote: post #42

Earlier quoted context omitted.

Tangent story. Two friends of mine went backpacking to Amsterdam, short pants and all. When they got out of the train in the evening, a friendly guy approached them and asked if they were looking for a hotel. They said yes, so he told them to follow him. Delighted to be greeted in this way, they did. First they went down the regular path up Damrak to get to Leidseplein, but slowly and imperceptibly the streets were g…

Makes me think of one of my personal rules when traveling. If I am needing help, I don't take it from someone who approaches me. I just say, no thank you. If I need help, I pick someone randomly and ask for help. The likelihood that they are a criminal is much less compared to someone who approaches me.

This is also good advice for children.

If you need help, ask, don't wait to be asked.

Re: Endlessh: An SSH Tarpit

#72

Post by Symbiote »

efreak wrote: post #62
dawnerd wrote: post #44

Earlier quoted context omitted.

Just an obvious protip to test that your cert works before banning password auths. I uh, found out the hard way.

I never had an issue with authentication. My issue was a typo in sudoers (I allowed a user to view syslog, iirc, and had a semicolon instead of a colon) that prevented me from using sudo, as only my primary user was allowed to log in via ssh. Fortunately cloud vps still has vnc login, and I actually had a root password. Now I use a root shell to edit sudoers, so I can test it before dropping root.

You should use "visudo", which opens the file in the default editor, then validates it before saving.

Re: Endlessh: An SSH Tarpit

#73

Post by tptacek »

Drdrdrq wrote: post #67
tptacek wrote: post #41

I'm sure this was fun to put together and it seems like it's fun for people to talk about, but you can put this along with fail2ban, port knocking, and nonstandard SSH ports in the back of the attic and just (1) turn off password authentication entirely and (2) put SSH behind WireGuard. Even if you don't do step (2), step (1) eliminates the rationale for all the silly stuff people do to obfuscate their SSH installs.

Could you elaborate on WireGuard part? Do you mean that users must first VPN, and only then can SSH, or something else?

Yes. This is how SSH access to prod works in most large companies: you have to be behind the VPN to get it.

Re: Endlessh: An SSH Tarpit

#74

Post by mdaniel »

geocrasher wrote: post #54

I have to admit that I tried this and it was rather lackluster. Log output: https://pastebin.com/4FTHRF3f Not a lot of activity over the time I ran it, and I know that the port gets hit more than that. I had a much better time when I ran a honeypot with Kippo: https://github.com/desaster/kippo It was much more useful as it gave me a great list of IP's to block from all my systems ;)

The top of the readme for that repo advises to use the fork: https://github.com/cowrie/cowrie

Re: Endlessh: An SSH Tarpit

#75

Post by pnutjam »

Symbiote wrote: post #72
efreak wrote: post #62

Earlier quoted context omitted.

I never had an issue with authentication. My issue was a typo in sudoers (I allowed a user to view syslog, iirc, and had a semicolon instead of a colon) that prevented me from using sudo, as only my primary user was allowed to log in via ssh. Fortunately cloud vps still has vnc login, and I actually had a root password. Now I use a root shell to edit sudoers, so I can test it before dropping root.

You should use "visudo", which opens the file in the default editor, then validates it before saving.

if you edit outside of visudo, you can run visudo -cf .

example: visudo -cf /etc/sudoers visudoe -cf /etc/sudoers.d/extra

Re: Endlessh: An SSH Tarpit

#76

Post by dheera »

belorn wrote: post #18
xoa wrote: post #8

Are tarpits still of use these days? I sort of figured that even modern script mass attackers have gotten professionalized and sophisticated enough that they can deal with trivial timeouts and the like. I could see actual honeypots still being of use for researchers or blue teams at organizations that are real targets, and ML might even open up some interesting new ways to make those more engaging for longer. But a t…

For individuals and smaller orgs the easiest and by experience the best practice is to use a certificate (or generated and never to be reused password) for ssh authentication, install server monitoring, and then simply observe if the spam from random drive-by causes enough resource drain that would validate further work. Most likely it won't. Running a tar pit is a bit like installing a trap on a bike in order to tea…

> installing a trap on a bike in order to teach bike thieves a lesson. It won't really reduce the problem

Maybe it is reducing the problem, but not enough people are installing traps to make a noticeable difference? Or the number of new thieves is cancelling out the number of thieves being put out of business by traps? Is there data for this?

Or maybe the traps just aren't sophisticated enough?

Re: Endlessh: An SSH Tarpit

#77

Post by FullyFunctional »

toxik wrote: post #65
jchook wrote: post #59

Earlier quoted context omitted.

This is why folks use techniques like greylisting and why you should almost never use a catch-all mailbox. Spamhaus usually stops a big chunk of them too.

Hard disagree on catch all. A catch all allows you to trace who gave your address to spammers, and then to bin all email to that address.

Yep, I've been doing this for nearly a decade. This in combination with Gmail's spam filter works just fine. I have caught quite a few emails to my parents from people who can't spell their (simple) email address.

Re: Endlessh: An SSH Tarpit

#78

Post by spc476 »

xoa wrote: post #8

Are tarpits still of use these days? I sort of figured that even modern script mass attackers have gotten professionalized and sophisticated enough that they can deal with trivial timeouts and the like. I could see actual honeypots still being of use for researchers or blue teams at organizations that are real targets, and ML might even open up some interesting new ways to make those more engaging for longer. But a t…

About 15 years ago, I ran a tarpit at my then current job (small ISP for commercial clients and web hosting) that tarpitted all TCP traffic on unused IP blocks. It did slow down network scans and had I gotten around to it, I could have probably set up some way of automatically blocking the IP addresses hitting the tarpit (as no legitimate traffic should hit it).

Re: Endlessh: An SSH Tarpit

#79

Post by spc476 »

k33n wrote: post #23

The tarpit approach is a double-edged sword. Sure, you're keeping some script kiddie's machine locked up (maybe), but you're also keeping socket connections open and wasting resources on the machine they are targeting. A much more efficient approach is using fail2ban and a firewall to just drop traffic from offenders.

Depends upon how you are doing the tarpitting. Back when I did this (15 years ago) I used a program that created a raw socket to handle all TCP traffic that just responded with 0-byte sized windows to all TCP packets (so overhead was minimal). I placed this software on a dedicated server (an old box that wasn't being used otherwise) and routed all our unused IP space to this system. It could keep thousands of connections "live" with minimal resources.

Re: Endlessh: An SSH Tarpit

#80

Post by a1369209993 »

mtlynch wrote: post #31
k33n wrote: post #23

The tarpit approach is a double-edged sword. Sure, you're keeping some script kiddie's machine locked up (maybe), but you're also keeping socket connections open and wasting resources on the machine they are targeting. A much more efficient approach is using fail2ban and a firewall to just drop traffic from offenders.

Tarpits aren't really a defense mechanism. They're meant to waste attackers' time and study their techniques, making attacks more expensive. It's sort of like those YouTube channels where they waste phone scammers' time in an entertaining way. [0] Obviously, the easiest thing for the callee to do is hang up the phone, but their goal is to make phone scams less profitable. [0] https://en.wikipedia.org/wiki/Jim_Brownin…

> where they waste phone scammers' time in an entertaining way.

This can also be automated, so the defender doesn't even need to waste their own time on it. Eg: https://old.reddit.com/r/itslenny/ .

Post reply on HN