11 ms·
Endlessh-go: a Golang SSH tarpit that traps bots/scanners
- schlonger0009 3y agoDoes it matter, though? You can easily scan out the correct SSH port.
- nilsherzig 3y agoScanning all 65k ports takes time. Those aren't targeted attacks, just bots connecting to every 22 ports they can find
- nilsherzig 3y agoScanning all 65k ports takes time. Those aren't targeted attacks, just bots connecting to every 22 ports they can find
- dugite-code 3y agoDepends on how well programed the bot is I guess. Personaly I use the encrypted packet port knocking package fwknop on my home server to hide the ssh port until I need it.
- scsh 3y agoThe point of this isn't to hide your actual SSH service, but to tie up resources for those who are somewhat blindly scanning/connecting to any open SSH port.
- bayindirh 3y agoYou can setup a VPN (or head/tailscale) and confine your "real" sshd there, and leave one of these tarpits in the open for fun and profit.
- Svip 3y agoThe original endlessh hints at this, but doesn't go further into details, and the endlessh-go's README doesn't mention it at all. Am I suppose to have endlessh run on port 22 and then have my real SSH server run on an obscure port? In none of the examples does it run on port 22. I feel like I'm missing something obvious, that the READMEs simply take for granted I know.
- agilob 3y agoYes, check this distro https://hub.docker.com/r/linuxserver/endlessh https://hub.docker.com/r/linuxserver/endlessh
- nilsherzig 3y agoThat's how I have it setup
- nubinetwork 3y agoI don't think it matters, ssh bots will try any port that sends back the ssh banner.
- freedomben 3y agoThe more targeted/sophisticated ones will, but there's a crapload of bots that just scan all publicly addressable IPs for port 22 and attempt to connect. If your goal is to trap as many bots as possible in the tarpit, you'll get a lot more if you run on port 22.
- deleted 3y ago[deleted]
- skrause 3y agoBut they don't scan every port. I've been running my SSH server on a non-standard port for a long time, it took four years until I had the first bot with login attempts. About a year ago I changed the port and haven't seen any bots since then.
- qwertox 3y agoYou can surround your custom port by a couple of ports on which a simple server listens for connection attempts. Any connection attempt is considered hostile and the ip will then be blacklisted in iptables. This prevents portscans from reaching your port.
- gnfargbl 3y agoGolang works well for this application because it can easily cope with very large numbers of idle goroutines. What the author may be missing is that golang also works well for bots and scanners, for exactly the same reason. Attackers' time isn't being "wasted" by this, their goroutines are just sitting idle for longer.
- da768 3y agoThough for a large amount of HTTP bots, the authors don't even bother changing the default Python User-Agent. I'd assume a large proportion of these bots still can't run concurrently.
- aesh2Xa1 3y agoI think it still works. You have two scenarios where the attacker is efficiently using goroutines; (1) you also use goroutines or (2) you do not. In the latter, the attack is more expensive for you. Another detail is that an attacker with many idle connections to your host might not instantiate any new ones. Of course, in the scenarios where the attacker is not using goroutines then you have the upper hand as well.
- gnfargbl 3y agoThis isn't a real ssh server, so the "cost" to you of the attack isn't really relevant. You can choose not to run this software at all, and the additional cost to you is zero.
- daghamm 3y agoBut the bots can easily detect these, cant they? As long as there is a timeout on socket read, this shouldn't waste that much of the scanners time. Or am I misunderstanding this?
- c0wb0yc0d3r 3y agoYes a bot can, and sophisticated bots do. At the same time it's much easier to write code that just died the bare minimum. Imagine you're a bot herder, if your bot net consists of stolen CPU cycles what difference does it make if your bots are slowed down. It doesn't cost you money.
- throw10920 3y ago> if your bot net consists of stolen CPU cycles what difference does it make if your bots are slowed down. It doesn't cost you money. This is wrong. It does cost you money - either directly, because you paid money to use someone else's botnet, or as an opportunity cost, in that you can't use your bots on as many targets.
- LysPJ 3y agoEndlessh periodically sends data so the read timeout won't trigger. Specifically, it draws out the crypto negotiation stage indefinitely by exploiting a feature of the SSH protocol. (Of course, the bot author could detect that behaviour too.) There's more info from the author of Endlessh: https://nullprogram.com/blog/2019/03/22/ https://nullprogram.com/blog/2019/03/22/
- gnfargbl 3y agoYou're understanding perfectly. The way this works is that it sends a slow drip of junk before the SSH version banner string. A scanner running at any real scale is going to have an overall timeout beyond which it doesn't bother waiting any longer for the banner string. This is going to very slightly irritate some of the extremely low-level actors. Is setting up a tool to do that a good use of time? If you want to effectively deter attackers using a sand-trap approach, you need to find some kind of task with asymmetric cost in your favour. This isn't that.
- HumblyTossed 3y ago> Unfortunately the wonderful original C implementation of endlessh only provides text based log, but I do not like the solution that writes extra scripts to parse the log outputs, then exports the results to a dashboard, because it would introduce extra layers in my current setup and it would depend on the format of the text log file rather than some structured data. Thus I create this golang implementation of endlessh to export Prometheus metrics and a Grafana dashboard to visualize them. " I didn't like the logging, so I re-implemented the entire thing." I'm not mocking, I just see this often (and have done it myself!). It's interesting the things we do to get around the little things we don't like.
- ffsm8 3y agoThe thing about coders is that they're often creators at heart. The stated reason is likely only the excuse they told themselves to justify the project. But the real reason was likely that they wanted to create something, and this was a good justification. Might just be me projecting though, because I do that all the time
- yard2010 3y agoI've stopped lying to myself, I'm making cool stuff just for the sake of it. It's like playing a video game, it doesn't have to be productive if I enjoy it.
- ajsnigrutin 3y ago> " I didn't like the logging, so I re-implemented the entire thing." And did that in the "language of the week" :) The stuff that was reinvented in eg. ruby a few years ago is now reinvented in go and rust.
- pantsforbirds 3y agoPeople build in languages they are comfortable with. Golang is fairly easy to ship with and the performance is fine for something like this. Seems like a good tool for the job
- ok123456 3y agoFollowing the SSH hardening guide stops 99% of bots and scanners because they can't negotiate a cipher using whatever ancient ones their SSH implementation is set up to use.
- Bender 3y agoThis, and a handful of simple firewall rules in the raw table can block about 90%+ of that remaining 1% just looking at the spoofable banner that none of the bots seem to spoof I assume due to being lazy like me. In the raw table: -A PREROUTING -i eth0 -p tcp -m tcp --dport 22 -d [my server ip] -m string --string "SSH-2.0-libssh" --algo bm --from 10 --to 60 -j DROP -A PREROUTING -i eth0 -p tcp -m tcp --dport 22 -d [my server ip] -m string --string "SSH-2.0-Go" --algo bm --from 10 --to 60 -j DROP -A PREROUTING -i eth0 -p tcp -m tcp --dport 22 -d [my server ip] -m string --string "SSH-2.0-JSCH" --algo bm --from 10 --to 60 -j DROP -A PREROUTING -i eth0 -p tcp -m tcp --dport 22 -d [my server ip] -m string --string "SSH-2.0-Gany" --algo bm --from 10 --to 60 -j DROP -A PREROUTING -i eth0 -p tcp -m tcp --dport 22 -d [my server ip] -m string --string "ZGrab" --algo bm --from 10 --to 60 -j DROP -A PREROUTING -i eth0 -p tcp -m tcp --dport 22 -d [my server ip] -m string --string "MGLNDD" --algo bm --from 10 --to 60 -j DROP -A PREROUTING -i eth0 -p tcp -m tcp --dport 22 -d [my server ip] -m string --string "amiko" --algo bm --from 10 --to 60 -j DROP Adding the server IP minimizes risks of also blocking outbound connections as raw is stateless I rarely do this any more given they rotate through so many LTE IP's. Instead I get the bot operators to block me by leaving SSH on port 22 and then giving them a really long VersionAdendum that seems to get the bots feeling broken, sticky and confused. There are far fewer SSH bot operators than it appears. They will still show up in the logs but that can be filtered out using drop patterns in rsyslog. VersionAddendum " just put in a really long sentence in sshd_config that is at least 320 characters or more" Try it out on a test box that you have console access to just in case your client is old enough to choke on it. Optionally use offensive words for the bots that log things to public websites. Only do this on your hobby nodes, not corporate owned nodes unless legal is cool with it, in writing.
- Snawoot 3y agoWhy use PREROUTING chain? You could have achieved same with INPUT chain without specification of ingress interface and server IP address.
- sandos 3y agoI think you could employ the same tactics that advanced fuzzers do with these tarpits: then mutate the responses randomly, to try get "new" responses from the attackers, instead of new coverage in the code as in the fuzzer. Unless they are using static scripts, which would be boring. I have understood that most attacks are super-simple sort of, so probably not much to learn there. But an interesting project!
- INTPenis 3y agoFunny but my first thought wasn't wasting their time at all, that's easily fixed with a few code adjustments on their client end. My thought was to harvest their IPs and publish them in blocklists.
- lez 3y agoFor other usecases there is an ipfilter target TARPIT, that does a similar thing on the TCP level.
- hwbunny 3y agoBut why? Just hide your ssh port. And port knock in. Or put it @ tor/wg/whatever.