Great idea! I'm not sure we should be writing new network connected daemons in C though.
Until there's a better alternative to C at its level of performance, people will keep using C.
Endlessh: An SSH Tarpit
91–100 of 107 posts
Re: Endlessh: An SSH Tarpit
#92What got my inspired here is, if a simple delay strategy can make attack harder, why not add this as a common feature in SSH?
It can be called "Initial Connection Delay": Once a new TCP connection is established, wait for an uncertain number of n seconds before read and respond to the handshake request.
Re: Endlessh: An SSH Tarpit
#93Earlier quoted context omitted.
People will approach tourists a lot like this in central and south america, but the end game tends to be to take the tourist to an inn or restaurant where they get a commission for taking them. I've never gone with anyone anywhere but very public spaces. But I actually have found some real gems tucked away off the beaten path this way.
Spouse and I got hooked like this when we visited Beijing some years ago. We could actually tell what was going on, but our "guide" was a friendly university-aged girl who (at our request) took us to a couple of local art galleries and a wonderful restaurant. She may have gotten a commission and definitely a good meal out of it, but we actually had a fine experience.
So you are saying rand16() needs to be replaced with an extract from some PD world literary piece, then the attacker will be fine. Call me sceptical.
Re: Endlessh: An SSH Tarpit
#94Earlier quoted context omitted.
People will approach tourists a lot like this in central and south america, but the end game tends to be to take the tourist to an inn or restaurant where they get a commission for taking them. I've never gone with anyone anywhere but very public spaces. But I actually have found some real gems tucked away off the beaten path this way.
A friend and I took a day trip to Morocco many years ago while backpacking through Spain and experienced this. A local guide approached us who came across as pretty legit and had a driver. We had a good time being shown around to different stores and it was pretty clear that he was getting a kickback from the places we went. Had some nice mint tea, and a pretty good meal later. There was a slightly dark time in the m…
Danish Louisa Vesterager Jespersen (24) and Norwegian Maren Ueland (28) were killed and decapitated by ISIS terrorists on a trip to Morocco in 2018. They were found near the Atlas mountains. The murders were filmed and put on the internet. 18 men were since arrested by Moroccan police and charged with terrorism.[1]
[1]: https://en.wikipedia.org/wiki/Murders_of_Louisa_Vesterager_J...
Re: Endlessh: An SSH Tarpit
#95Earlier quoted context omitted.
You should use "visudo", which opens the file in the default editor, then validates it before saving.
But make sure to change the default editor to something sane first. (* ducks *) :q!dammitwtf
+1 to that!
I like nano, and I'm not ashamed to admit it.
Re: Endlessh: An SSH Tarpit
#96One of the simplest ways to block unwanted connections is to filter on client id. I haven't seen anyone willing to change it even though I've blocked libssh, sshgo, and paprika.
Of course, this functionality is only available in non-standard SSH servers such as the one from Bitvise.
Re: Endlessh: An SSH Tarpit
#97https://github.com/carlmjohnson/heffalump
This seems like it would use a lot of bandwidth?
Re: Endlessh: An SSH Tarpit
#98Earlier quoted context omitted.
A friend and I took a day trip to Morocco many years ago while backpacking through Spain and experienced this. A local guide approached us who came across as pretty legit and had a driver. We had a good time being shown around to different stores and it was pretty clear that he was getting a kickback from the places we went. Had some nice mint tea, and a pretty good meal later. There was a slightly dark time in the m…
Danish Louisa Vesterager Jespersen (24) and Norwegian Maren Ueland (28) were killed and decapitated by ISIS terrorists on a trip to Morocco in 2018. They were found near the Atlas mountains. The murders were filmed and put on the internet. 18 men were since arrested by Moroccan police and charged with terrorism.[1] [1]: https://en.wikipedia.org/wiki/Murders_of_Louisa_Vesterager_J...
Somehow factual information like that is always downvoted, but criminal and terrorist activity is important information when considering where you want to travel in the world, so you should take it very seriously.
Case in point, I travelled with my friends through Serbia during the early 2000's. Now, we'd spoken with our country's foreign ministry, and they told us that it was relatively safe to travel in the North of the country. At the time, we were adviced to avoid the South of Serbia because of small gang clashes still being ongoing. We avoided Romania as well, since a lot of car jackings had been reported at the time.
After driving for a very long time, we got tired, and parked at a forest road in the darkness. It was pitch black, so we figured no one would come there. But after a while, I heard a car stop down at the main road, and two guys moving closer to our car on the gravel. This prompted me to reach for a small screw driver I had laying around, just in case.
When they arrived at the car, they knocked on my window, and peering to the darkness I noticed that they were actually police officers. They wanted to know what we were doing there, so I explained to them that we were just trying to get some sleep for the night.
Then they asked me, "Did you see the boarded-up gas station further up the road?" I nodded, and he continued. "Yeah, well, last week a gang came by there and shot the whole family dead, mother, father and two kids. That's why the place is boarded up. Listen, guys, this place isn't safe. So please come with us, and we'll show you a lit parking lot in the nearest town. You can sleep safely there, under the lights."
Needless to say, we accepted their escort, although it was far more easy to sleep in the darkness rather than under a street light.
Then there's the story of my boss who ignored advice to not go to Egypt during some troubled times, and ended up in a firefight as the bus in front of him was lit up by a hail bullets. He thought he was going to die, and he very well could have if he'd gone with the front bus.
Re: Endlessh: An SSH Tarpit
#99Earlier quoted context omitted.
True, but having supported an sftp server for other b2b clients to upload data, ssh keys are black magic to too many people. I can't count the hours I've spent trying to explain them, how to generate them and why you should never "show anyone your privates", just your publics.
It would be more obvious if the private key files were named “id_ed25519.private”. Why not make it “identity.ed25519.private.sshkey” and default to “20200916{,T224400Z}.ed25519.{private,public}.sshkey”?
Put in a feature request to the openssh guys. Theo can probably tell you why it's not a good idea, or why it is good idea.
Re: Endlessh: An SSH Tarpit
#100Earlier quoted context omitted.
Don't forget fail2ban or something similar. 2 hour lockout after 4 bad tries does wonders to discourage bots.
I don't like it because it opens up the possibility of someone on the same network as me locking me out of my own server. Sure, it's unlikely, but I don't see what I'd be gaining using fail2ban in the first place. I don't leave password authentication enabled, of course. Log spam is a bit annoying, but at the end of the day, who cares? Even with the ongoing attempts, my authlog is like 300K uncompressed today and 60-…
If your passing through a NAT, you can whitelist your own IP.
something like: fail2ban-client set addignoreip x.x.x.x or fail2ban-client set addignoreregex hostname.com