4 ms·

I'm not sure I like this. How secure is it? Anything you put on port 22 is going to be attacked relentlessly. I think I'd rather have OpenSSH handling those att

I'm not sure I like this. How secure is it? Anything you put on port 22 is going to be attacked relentlessly. I think I'd rather have OpenSSH handling those attacks than some tarpit program that may or may not have been subjected to the audits and the trial-by-fire that OpenSSH has.

nemo1618 8y ago
A program like this has vastly less attack surface than a full SSH protocol implementation. In particular, it doesn't support the part of the SSH protocol that allows executing commands on a remote host. So the only way this will be less secure than OpenSSH is if there's some memory unsafety or a leak of some kind.
- throwaway2048 8y ago
  almost all of the SSH protocol isn't exposed until you authenticate, and in the vast majority of setups that means you get a shell to execute commands with anyways, so while still important, the key problems are with pre-auth security.
  - nemo1618 8y ago
    Sure, but "isn't exposed" is very different from "that functionality is physically not present in this executable."
tyingq 8y ago
Any tarpit has the potential to piss someone off. I'd run it on a sacrificial server with no obvious way to tie back to who is running it.
- sverige 8y ago
  Why worry about pissing off the kind of person who scans for open SSH ports for no apparent legitimate reason? Are you concerned that the Chinese are going to try even harder to hack your machine, like they're not already doing everything they can to break in?
  - stcredzero 8y ago
    The vast majority are going for the low hanging fruit. I don't have to outrun the bear. I just have to outrun you.
  - tyingq 8y ago
    They may be the same type of person that would launch a ddos, for example.
    - JohnFen 8y ago
      I'm not concerned about this, personally. On my home server, there are only two ports open to the internet -- one for my SSH server, and one for my VPN server. Both of those are running on nonstandard ports. In order to DDOS me, an attacker has to find those ports, which would require a comprehensive scan (increasing the chances that they'll get blocked by my ISP or detected by my antiscan monitor) or a huge amount of luck. And even then, they'll just be able to DDOS my SSH server and VPN. That wouldn't be awesome, but wouldn't exactly be disastrous.
      - crtasm 8y ago
        If your IP doesn't change that often or is static, I'm curious how much Shodan knows about your open ports?
      - VvR-Ox 8y ago
        You can change your ports but it won't prevent "Eve" from scanning for those as you mention yourself. I think this belongs to the realm of "security through obscurity" tactics and won't be safe in the long run. I can prevent being blocked by your ISP by adjusting the timings etc. of my scripts. I think it's far more important to take a look at the supported key exchange algorithms etc.
        JohnFen 8y ago
        You are correct. This falls into the cost/benefit calculation of security. A DDOS attack on my home network would be annoying, but not devastating, so I'm willing to accept a little vulnerability to them in exchange for other benefits. > I can prevent being blocked by your ISP by adjusting the timings etc. of my scripts. But that won't let you escape detection by my system's own defenses. Well, you could if you slowed down the scan enough -- but "enough" is pretty darned slow.
- spc476 8y ago
  You can always tie it to the organization who is running it, by the simple fact of looking at the IP address that is "acting slow". Years ago when I was playing network admin for a company, I set up a tarpit system which ran for a few years. In that time we never encountered one pissed off person in person (or on the Internet).
  - deleted 8y ago
    [deleted]
Chilinot 8y ago
It's as safe as it can get. None of the versions he showed in the post actually read any data from the attacker. It only accepts the connection, then writes random data to it every 10 seconds forever.
mhink 8y ago
I'm not sure I catch your drift. It seems like the point is that it doesn't actually implement the SSH protocol- it just exploits the fact that a real SSH server is perfectly within its rights to send any data it wants to before a version string. (And on top of that, it looks like it doesn't even read anything from the socket?) Is there something I'm missing here (probably related to poll(2)) that could cause this to be insecure?
JohnFen 8y ago
> How secure is it? Since it doesn't actually have the ability to do anything, it's pretty darned secure.
craftyguy 8y ago
The source code in the article shows that your concerns aren't really.. concerns.

nemo1618 8y ago

A program like this has vastly less attack surface than a full SSH protocol implementation. In particular, it doesn't support the part of the SSH protocol that allows executing commands on a remote host. So the only way this will be less secure than OpenSSH is if there's some memory unsafety or a leak of some kind.

throwaway2048 8y ago
almost all of the SSH protocol isn't exposed until you authenticate, and in the vast majority of setups that means you get a shell to execute commands with anyways, so while still important, the key problems are with pre-auth security.
- nemo1618 8y ago
  Sure, but "isn't exposed" is very different from "that functionality is physically not present in this executable."

tyingq 8y ago

Any tarpit has the potential to piss someone off. I'd run it on a sacrificial server with no obvious way to tie back to who is running it.

sverige 8y ago
Why worry about pissing off the kind of person who scans for open SSH ports for no apparent legitimate reason? Are you concerned that the Chinese are going to try even harder to hack your machine, like they're not already doing everything they can to break in?
- stcredzero 8y ago
  The vast majority are going for the low hanging fruit. I don't have to outrun the bear. I just have to outrun you.
- tyingq 8y ago
  They may be the same type of person that would launch a ddos, for example.
  - JohnFen 8y ago
    I'm not concerned about this, personally. On my home server, there are only two ports open to the internet -- one for my SSH server, and one for my VPN server. Both of those are running on nonstandard ports. In order to DDOS me, an attacker has to find those ports, which would require a comprehensive scan (increasing the chances that they'll get blocked by my ISP or detected by my antiscan monitor) or a huge amount of luck. And even then, they'll just be able to DDOS my SSH server and VPN. That wouldn't be awesome, but wouldn't exactly be disastrous.
    - crtasm 8y ago
      If your IP doesn't change that often or is static, I'm curious how much Shodan knows about your open ports?
    - VvR-Ox 8y ago
      You can change your ports but it won't prevent "Eve" from scanning for those as you mention yourself. I think this belongs to the realm of "security through obscurity" tactics and won't be safe in the long run. I can prevent being blocked by your ISP by adjusting the timings etc. of my scripts. I think it's far more important to take a look at the supported key exchange algorithms etc.
      - JohnFen 8y ago
        You are correct. This falls into the cost/benefit calculation of security. A DDOS attack on my home network would be annoying, but not devastating, so I'm willing to accept a little vulnerability to them in exchange for other benefits. > I can prevent being blocked by your ISP by adjusting the timings etc. of my scripts. But that won't let you escape detection by my system's own defenses. Well, you could if you slowed down the scan enough -- but "enough" is pretty darned slow.
spc476 8y ago
You can always tie it to the organization who is running it, by the simple fact of looking at the IP address that is "acting slow". Years ago when I was playing network admin for a company, I set up a tarpit system which ran for a few years. In that time we never encountered one pissed off person in person (or on the Internet).
- deleted 8y ago
  [deleted]

Chilinot 8y ago

It's as safe as it can get. None of the versions he showed in the post actually read any data from the attacker. It only accepts the connection, then writes random data to it every 10 seconds forever.

mhink 8y ago

I'm not sure I catch your drift. It seems like the point is that it doesn't actually implement the SSH protocol- it just exploits the fact that a real SSH server is perfectly within its rights to send any data it wants to before a version string. (And on top of that, it looks like it doesn't even read anything from the socket?) Is there something I'm missing here (probably related to poll(2)) that could cause this to be insecure?

JohnFen 8y ago

> How secure is it? Since it doesn't actually have the ability to do anything, it's pretty darned secure.

craftyguy 8y ago

The source code in the article shows that your concerns aren't really.. concerns.