8 ms·

For this reason I've put `endlessh` on port 22 and moved actual ssh elsewhere... Also started using Crowdsec recently, but not sure about if it's worth it...

For this reason I've put `endlessh` on port 22 and moved actual ssh elsewhere... Also started using Crowdsec recently, but not sure about if it's worth it... fail2ban out of the box works fine for SSH, but for dovecot and postfix it's somehow broken, and the configuration scripts are just too obtuse.

kenniskrag 3y ago
Nice idea. From the docs: Endlessh is an SSH tarpit that very slowly sends an endless, random SSH banner. It keeps SSH clients locked up for hours or even days at a time. The purpose is to put your real SSH server on another port and then let the script kiddies get stuck in this tarpit instead of bothering a real server. Since the tarpit is in the banner before any cryptographic exchange occurs, this program doesn't depend on any cryptographic libraries. It's a simple, single-threaded, standalone C program. It uses poll() to trap multiple clients at a time. https://github.com/skeeto/endlessh https://github.com/skeeto/endlessh
- jhartwig 3y ago
  Wow. That is pretty brilliant.
- artursapek 3y ago
  That’s hilarious
- operator-name 3y ago
  I'd be cautious about stuff like this - if you annoy the wrong person that could paint a target on your back.
  - capableweb 3y ago
    Realistically though, they'll probably timeout by themselves automatically if they haven't seen a password prompt after N seconds. TCP connections can hang overall, so having that would be basics anyway.
  - internetter 3y ago
    Ah where's your sense of fun ;)
  - dylan604 3y ago
    Don't discourage someone else from doing it and risk their not coming back to update us on the results. This popcorn is not going to eat itself.
  - Zetice 3y ago
    They're impotent little weasels who couldn't hit a target the size of a barn, so the risk is minimal.
    - fsckboy 3y ago
      "do not guess that it will be your weakest opponent nor guess what they will try, prepare for your strongest adversary and all that they can do" -- mutatis mutandis, Sun Tzu, Art of War
      - l33t233372 3y ago
        Not to disagree with infallible thousands of years old advice, but surely resources are in far shorter supply than potential attacks, so we have to prioritize and filter.
  - myself248 3y ago
    If this was default on port 22 of every cheap router sold, and if you enable ssh it has to go on some other port, it'd frustrate a lot of bad guys.
- avidiax 3y ago
  I spent 10 minutes to set this up. I was shocked to see that I got my first taker less than a second after I opened port 22 on my firewall. https://www.abuseipdb.com/check/178.62.237.183 https://www.abuseipdb.com/check/178.62.237.183 Unfortunately, it only wasted 30 seconds of that IP's time. It's not clear what type of tarpit would waste the most of the operator's time. Maybe something like a "byzantine VM", that seems exploitable, takes payloads, passes initial checks, and then starts having "problems". DDOS attacks redirect to the C&C server. Coin miners report false mined coins. Hosted files have corruption, and won't complete transfer, etc. Whatever it is, it needs to somehow seem like the operator has an error in their code :)
  - Breza 3y ago
    Reminds me of a tactic I tried with telemarketing scams when on paternity leave. I got so many calls like "Your Social Security Number is about to be revoked" that I developed an entire persona with a name, address, SSN, income, debts, and other factors. I spent several baby-naps looking up jobs, apartments, car loan interest rates, and other factors to make the persona as realistic as possible. My wife talked me out of buying a $5 Visa gift card with cash so I could give the scammers a credit card number and keep them talking longer.
  - tornato7 3y ago
    Remember the guy who asked ChatGPT to pretend to be a terminal, you could probably do something similar to mess with SSH intruders.
sltkr 3y ago
That seems like overkill. I just disable password authentication, and use SSH public keys only. It prevents brute force attacks completely.
- BrandoElFollito 3y ago
  This, and move the endpoint on an uninteresting port to lower the noise in the logs
  - KMag 3y ago
    ... and avoid automated attacks in case a 0-day in the pre-authentication OpenSSH server code shows up
    - hsbauauvhabzb 3y ago
      If there’s a preauth RCE in ssh, I’m sure threat actors will start scanning non default ports once their hornets have hit critical mass.
  - NoZebra120vClip 3y ago
    I suppose it may do that, but naïvely switching to an alternate port may lull one into a false sense of security: https://utcc.utoronto.ca/~cks/space/blog/sysadmin/SSHAltPortNoSecurity https://utcc.utoronto.ca/~cks/space/blog/sysadmin/SSHAltPort... Shodan will find and fingerprint you easily enough.
    - michaelcampbell 3y ago
      In theory. I have a server running on a weird port, but with fail2ban just in case. I haven't had even a blip of an attempt on it.
- ravi-delia 3y ago
  It's not for security, it's public service and entertainment
bootsmann 3y ago
Do the dovecot and postfix scenarios work well for you with crowdsec? Always like hearing user stories :)
- vsviridov 3y ago
  I think the blocklists have filtered out a bunch of that noise, so from a straigh-up dovecot logs I've not seen much yet...

kenniskrag 3y ago

Nice idea. From the docs: Endlessh is an SSH tarpit that very slowly sends an endless, random SSH banner. It keeps SSH clients locked up for hours or even days at a time. The purpose is to put your real SSH server on another port and then let the script kiddies get stuck in this tarpit instead of bothering a real server. Since the tarpit is in the banner before any cryptographic exchange occurs, this program doesn't depend on any cryptographic libraries. It's a simple, single-threaded, standalone C program. It uses poll() to trap multiple clients at a time. https://github.com/skeeto/endlessh https://github.com/skeeto/endlessh

jhartwig 3y ago
Wow. That is pretty brilliant.
artursapek 3y ago
That’s hilarious
operator-name 3y ago
I'd be cautious about stuff like this - if you annoy the wrong person that could paint a target on your back.
- capableweb 3y ago
  Realistically though, they'll probably timeout by themselves automatically if they haven't seen a password prompt after N seconds. TCP connections can hang overall, so having that would be basics anyway.
- internetter 3y ago
  Ah where's your sense of fun ;)
- dylan604 3y ago
  Don't discourage someone else from doing it and risk their not coming back to update us on the results. This popcorn is not going to eat itself.
- Zetice 3y ago
  They're impotent little weasels who couldn't hit a target the size of a barn, so the risk is minimal.
  - fsckboy 3y ago
    "do not guess that it will be your weakest opponent nor guess what they will try, prepare for your strongest adversary and all that they can do" -- mutatis mutandis, Sun Tzu, Art of War
    - l33t233372 3y ago
      Not to disagree with infallible thousands of years old advice, but surely resources are in far shorter supply than potential attacks, so we have to prioritize and filter.
- myself248 3y ago
  If this was default on port 22 of every cheap router sold, and if you enable ssh it has to go on some other port, it'd frustrate a lot of bad guys.
avidiax 3y ago
I spent 10 minutes to set this up. I was shocked to see that I got my first taker less than a second after I opened port 22 on my firewall. https://www.abuseipdb.com/check/178.62.237.183 https://www.abuseipdb.com/check/178.62.237.183 Unfortunately, it only wasted 30 seconds of that IP's time. It's not clear what type of tarpit would waste the most of the operator's time. Maybe something like a "byzantine VM", that seems exploitable, takes payloads, passes initial checks, and then starts having "problems". DDOS attacks redirect to the C&C server. Coin miners report false mined coins. Hosted files have corruption, and won't complete transfer, etc. Whatever it is, it needs to somehow seem like the operator has an error in their code :)
- Breza 3y ago
  Reminds me of a tactic I tried with telemarketing scams when on paternity leave. I got so many calls like "Your Social Security Number is about to be revoked" that I developed an entire persona with a name, address, SSN, income, debts, and other factors. I spent several baby-naps looking up jobs, apartments, car loan interest rates, and other factors to make the persona as realistic as possible. My wife talked me out of buying a $5 Visa gift card with cash so I could give the scammers a credit card number and keep them talking longer.
- tornato7 3y ago
  Remember the guy who asked ChatGPT to pretend to be a terminal, you could probably do something similar to mess with SSH intruders.

sltkr 3y ago

That seems like overkill. I just disable password authentication, and use SSH public keys only. It prevents brute force attacks completely.

BrandoElFollito 3y ago
This, and move the endpoint on an uninteresting port to lower the noise in the logs
- KMag 3y ago
  ... and avoid automated attacks in case a 0-day in the pre-authentication OpenSSH server code shows up
  - hsbauauvhabzb 3y ago
    If there’s a preauth RCE in ssh, I’m sure threat actors will start scanning non default ports once their hornets have hit critical mass.
- NoZebra120vClip 3y ago
  I suppose it may do that, but naïvely switching to an alternate port may lull one into a false sense of security: https://utcc.utoronto.ca/~cks/space/blog/sysadmin/SSHAltPortNoSecurity https://utcc.utoronto.ca/~cks/space/blog/sysadmin/SSHAltPort... Shodan will find and fingerprint you easily enough.
  - michaelcampbell 3y ago
    In theory. I have a server running on a weird port, but with fail2ban just in case. I haven't had even a blip of an attempt on it.
ravi-delia 3y ago
It's not for security, it's public service and entertainment

bootsmann 3y ago

Do the dovecot and postfix scenarios work well for you with crowdsec? Always like hearing user stories :)

vsviridov 3y ago
I think the blocklists have filtered out a bunch of that noise, so from a straigh-up dovecot logs I've not seen much yet...