The Slackware and Slackdce repos lack packages like... endlessh... toybox... and may others that are in Openmandriva.
Ultimately.. the roadmap is to compile (and harden) all of the packages even Slackware (upstream).
Ultimately.. the roadmap is to compile (and harden) all of the packages even Slackware (upstream).
September 10, 2026 at 1:53 PM
The Slackware and Slackdce repos lack packages like... endlessh... toybox... and may others that are in Openmandriva.
Ultimately.. the roadmap is to compile (and harden) all of the packages even Slackware (upstream).
Ultimately.. the roadmap is to compile (and harden) all of the packages even Slackware (upstream).
To nie zatrzyma zdeterminowanego atakującego. To tylko zabawki. Dzięki nim jednak zasoby atakujących są marnowane i nie mogą być użyte na serwery innych osób.
Czy mnie to coś kosztuje? Nie. Skan i tak miałby miejsce, a 3-4 wiszące dniami połączenia na endlessh są nieodczuwalne.
Czy mnie to coś kosztuje? Nie. Skan i tak miałby miejsce, a 3-4 wiszące dniami połączenia na endlessh są nieodczuwalne.
September 10, 2026 at 6:41 AM
To nie zatrzyma zdeterminowanego atakującego. To tylko zabawki. Dzięki nim jednak zasoby atakujących są marnowane i nie mogą być użyte na serwery innych osób.
Czy mnie to coś kosztuje? Nie. Skan i tak miałby miejsce, a 3-4 wiszące dniami połączenia na endlessh są nieodczuwalne.
Czy mnie to coś kosztuje? Nie. Skan i tak miałby miejsce, a 3-4 wiszące dniami połączenia na endlessh są nieodczuwalne.
EndleSSH działa sprytnie.
Wysyła nieskończony, losowo generowany banner SSH. Atakujący myśli, że nawiązuje normalne połączenie, a w rzeczywistości jego bot wisi na tym połączeniu godzinami (albo dniami).
W międzyczasie ja spokojnie korzystam z prawdziwego SSH na innym porcie.
Wysyła nieskończony, losowo generowany banner SSH. Atakujący myśli, że nawiązuje normalne połączenie, a w rzeczywistości jego bot wisi na tym połączeniu godzinami (albo dniami).
W międzyczasie ja spokojnie korzystam z prawdziwego SSH na innym porcie.
September 10, 2026 at 6:41 AM
EndleSSH działa sprytnie.
Wysyła nieskończony, losowo generowany banner SSH. Atakujący myśli, że nawiązuje normalne połączenie, a w rzeczywistości jego bot wisi na tym połączeniu godzinami (albo dniami).
W międzyczasie ja spokojnie korzystam z prawdziwego SSH na innym porcie.
Wysyła nieskończony, losowo generowany banner SSH. Atakujący myśli, że nawiązuje normalne połączenie, a w rzeczywistości jego bot wisi na tym połączeniu godzinami (albo dniami).
W międzyczasie ja spokojnie korzystam z prawdziwego SSH na innym porcie.
Pierwsza rzecz to zmiana portu SSH z domyślnego 22 na coś znacznie wyższego.
Na oryginalnym porcie 22 stawiam natomiast endleSSH - aplikację, która symuluje w pełni funkcjonalny serwer SSH, ale połączenie z nim zajmuje... no właśnie, bardzo długo.
Na oryginalnym porcie 22 stawiam natomiast endleSSH - aplikację, która symuluje w pełni funkcjonalny serwer SSH, ale połączenie z nim zajmuje... no właśnie, bardzo długo.
September 10, 2026 at 6:41 AM
Pierwsza rzecz to zmiana portu SSH z domyślnego 22 na coś znacznie wyższego.
Na oryginalnym porcie 22 stawiam natomiast endleSSH - aplikację, która symuluje w pełni funkcjonalny serwer SSH, ale połączenie z nim zajmuje... no właśnie, bardzo długo.
Na oryginalnym porcie 22 stawiam natomiast endleSSH - aplikację, która symuluje w pełni funkcjonalny serwer SSH, ale połączenie z nim zajmuje... no właśnie, bardzo długo.
공세적 인터넷 태세
블로그 VPS를 자동 스캐너·스크레이퍼·스패머 같은 인터넷 약탈자 에게 덜 매력적으로 만들기 위해 허니팟, 타르핏, 가짜 콘텐츠를 운영함 가짜 WordPress 로그인은 인증 거부를 5초 늦추고, endlessh 가 22번 포트를 점유하는 동안 실제 sshd 는 다른 포...
블로그 VPS를 자동 스캐너·스크레이퍼·스패머 같은 인터넷 약탈자 에게 덜 매력적으로 만들기 위해 허니팟, 타르핏, 가짜 콘텐츠를 운영함 가짜 WordPress 로그인은 인증 거부를 5초 늦추고, endlessh 가 22번 포트를 점유하는 동안 실제 sshd 는 다른 포...
공세적 인터넷 태세
블로그 VPS를 자동 스캐너·스크레이퍼·스패머 같은 인터넷 약탈자 에게 덜 매력적으로 만들기 위해 허니팟, 타르핏, 가짜 콘텐츠를 운영함 가짜 WordPress 로그인은 인증 거부를 5초 늦추고, endlessh 가 22번 포트를 점유하는 동안 실제 sshd 는 다른 포...
news.hada.io
August 6, 2026 at 1:00 AM
공세적 인터넷 태세
블로그 VPS를 자동 스캐너·스크레이퍼·스패머 같은 인터넷 약탈자 에게 덜 매력적으로 만들기 위해 허니팟, 타르핏, 가짜 콘텐츠를 운영함 가짜 WordPress 로그인은 인증 거부를 5초 늦추고, endlessh 가 22번 포트를 점유하는 동안 실제 sshd 는 다른 포...
블로그 VPS를 자동 스캐너·스크레이퍼·스패머 같은 인터넷 약탈자 에게 덜 매력적으로 만들기 위해 허니팟, 타르핏, 가짜 콘텐츠를 운영함 가짜 WordPress 로그인은 인증 거부를 5초 늦추고, endlessh 가 22번 포트를 점유하는 동안 실제 sshd 는 다른 포...
I need more things like this for the 'worlds most annoying honeypot'
endlessh is another favorite of mine.
endlessh is another favorite of mine.
July 31, 2026 at 1:56 PM
I need more things like this for the 'worlds most annoying honeypot'
endlessh is another favorite of mine.
endlessh is another favorite of mine.
Just find out about this
nullprogram.com/blog/2019/03...
nullprogram.com/blog/2019/03...
Endlessh: an SSH Tarpit
nullprogram.com
July 15, 2026 at 10:25 PM
Just find out about this
nullprogram.com/blog/2019/03...
nullprogram.com/blog/2019/03...
Personally I leave them on a non-standard 5 digit port number then leave a tarpit on 22 with endlessh.
So long as your password is good enough (or like you said you only use keys) and you keep the server up to date it'll be fine. Though port 22 is a big target for automatic brute for[...]
So long as your password is good enough (or like you said you only use keys) and you keep the server up to date it'll be fine. Though port 22 is a big target for automatic brute for[...]
See complete post at waf.c00lest-kats-on.ovh
waf.c00lest-kats-on.ovh is a Wafrn server. Wafrn is a federated social media inspired by Tumblr, join us and have fun!
waf.c00lest-kats-on.ovh
July 5, 2026 at 8:13 PM
Personally I leave them on a non-standard 5 digit port number then leave a tarpit on 22 with endlessh.
So long as your password is good enough (or like you said you only use keys) and you keep the server up to date it'll be fine. Though port 22 is a big target for automatic brute for[...]
So long as your password is good enough (or like you said you only use keys) and you keep the server up to date it'll be fine. Though port 22 is a big target for automatic brute for[...]
🐧 **endlessh-go – SSH tarpit**
endlessh-go is an SSH tarpit that slowly sends an endless SSH banner to clients, tying up bots and brute-force attackers. The post endlessh-go – SSH tarpit appeared first on LinuxLinks.
📰 Source: LinuxLinks
🔗 Link […]
endlessh-go is an SSH tarpit that slowly sends an endless SSH banner to clients, tying up bots and brute-force attackers. The post endlessh-go – SSH tarpit appeared first on LinuxLinks.
📰 Source: LinuxLinks
🔗 Link […]
Original post on igeek.gamer-geek-news.com
igeek.gamer-geek-news.com
July 2, 2026 at 11:24 AM
🐧 **endlessh-go – SSH tarpit**
endlessh-go is an SSH tarpit that slowly sends an endless SSH banner to clients, tying up bots and brute-force attackers. The post endlessh-go – SSH tarpit appeared first on LinuxLinks.
📰 Source: LinuxLinks
🔗 Link […]
endlessh-go is an SSH tarpit that slowly sends an endless SSH banner to clients, tying up bots and brute-force attackers. The post endlessh-go – SSH tarpit appeared first on LinuxLinks.
📰 Source: LinuxLinks
🔗 Link […]
Honeypot Design
Discussion | hackernews | Author: NaOH
Discussion | hackernews | Author: NaOH
Honeypot Design
I’ve run various honeypots for a long time. I ran a WordPress honeypot off and on from 2013 to 2018. I’ve run endlessh on my home server for years. Before that, I ran the cowrie ssh/telnet honey pot for a while.
bruceediger.com
June 16, 2026 at 5:27 AM
Honeypot Design
Discussion | hackernews | Author: NaOH
Discussion | hackernews | Author: NaOH
Reminds me of the SSH honeypots I run on most of my servers.
GitHub - skeeto/endlessh: SSH tarpit that slowly sends an endless banner
SSH tarpit that slowly sends an endless banner. Contribute to skeeto/endlessh development by creating an account on GitHub.
github.com
May 14, 2026 at 7:56 AM
Reminds me of the SSH honeypots I run on most of my servers.
ドット絵から普通の絵をみるとこっちもHで無限H機関の完成を感じるendlessH
March 26, 2026 at 1:19 PM
ドット絵から普通の絵をみるとこっちもHで無限H機関の完成を感じるendlessH
How bad must your ssh hacking bot be for it to willingly spend >5 hours stuck in endlessh
March 7, 2026 at 11:03 PM
How bad must your ssh hacking bot be for it to willingly spend >5 hours stuck in endlessh
A mention elsewhere of the insufferable ssh password guessers has me reprise my "The Hail Mary Cloud and the Lessons Learned" nxdomain.no/~peter/hailm... piece #ssh #passwords #passwordguessing #passwordgroping #endlessh #openbsd #freebsd #pf #packetfilter #security #cybercrime
The Hail Mary Cloud And The Lessons Learned
nxdomain.no
February 23, 2026 at 10:11 AM
A mention elsewhere of the insufferable ssh password guessers has me reprise my "The Hail Mary Cloud and the Lessons Learned" nxdomain.no/~peter/hailm... piece #ssh #passwords #passwordguessing #passwordgroping #endlessh #openbsd #freebsd #pf #packetfilter #security #cybercrime
A mention elsewhere of the insufferable ssh password guessers has me reprise my "The Hail Mary Cloud and the Lessons Learned" https://nxdomain.no/~peter/hailmary_lessons_learned.html piece, with a not added at the end about endlessh as a possible refinement (yes, I use it) #ssh #passwords […]
Original post on mastodon.social
mastodon.social
February 23, 2026 at 10:10 AM
A mention elsewhere of the insufferable ssh password guessers has me reprise my "The Hail Mary Cloud and the Lessons Learned" https://nxdomain.no/~peter/hailmary_lessons_learned.html piece, with a not added at the end about endlessh as a possible refinement (yes, I use it) #ssh #passwords […]
After having a fantastic day out, I came home and moved endlessh to my previous SSH port. It's caught so many bots that `journalctl` is hitting the log limit and discarding earlier logs. That makes me think these *aren't* random but sophisticated bots that search for something with an SSH server […]
Original post on defcon.social
defcon.social
February 23, 2026 at 7:59 AM
After having a fantastic day out, I came home and moved endlessh to my previous SSH port. It's caught so many bots that `journalctl` is hitting the log limit and discarding earlier logs. That makes me think these *aren't* random but sophisticated bots that search for something with an SSH server […]
Another interesting data point: I set up a tar pit using `endlessh` on the port below my actual SSH port, so it would theoretically catch dumb scanners that are attacking all ports sequentially. It caught nobody, which means either these are automated attackers scanning the internet, but […]
Original post on defcon.social
defcon.social
February 23, 2026 at 12:15 AM
Another interesting data point: I set up a tar pit using `endlessh` on the port below my actual SSH port, so it would theoretically catch dumb scanners that are attacking all ports sequentially. It caught nobody, which means either these are automated attackers scanning the internet, but […]
Set up github.com/shizunge/end... ~20h ago and I guess my server is somewhat popular?
August 17, 2025 at 6:25 PM
Set up github.com/shizunge/end... ~20h ago and I guess my server is somewhat popular?
🍻 endlessh 🍻
SSH tarpit that slowly sends an endless banner
🔗 https://github.com/skeeto/endlessh
#homebrew #newpkg #macos #linux #formula
SSH tarpit that slowly sends an endless banner
🔗 https://github.com/skeeto/endlessh
#homebrew #newpkg #macos #linux #formula
July 30, 2025 at 12:48 PM
🍻 endlessh 🍻
SSH tarpit that slowly sends an endless banner
🔗 https://github.com/skeeto/endlessh
#homebrew #newpkg #macos #linux #formula
SSH tarpit that slowly sends an endless banner
🔗 https://github.com/skeeto/endlessh
#homebrew #newpkg #macos #linux #formula
Endlessh を使って ssh 接続をとてもゆっくりと処理して攻撃者に嫌がらせをする – matoken's blog https://matoken.org/blog/2019/03/26/use-endlessh-to-handle-ssh-connections-very-slowly-and-harass-attackers/
Endlessh を使って ssh 接続をとてもゆっくりと処理して攻撃者に嫌がらせをする
ssh は攻撃が多いです．公開鍵認証にしておくと大分侵入に強くなりますがインターネットに直接繋がっているサーバでは攻撃はとても多いです．
Endlessh はsshd の代わりに起動してバージョン情報を送る前のデータにほぼランダムな文字列をゆっくりと配信し続けて攻撃者の足止めをするプログラムのようです．
本当の sshd は別ポートで起動してそっちを使う感じでしょうか．22番を無くして port knocking や sslh を使うなどのほうがいいかもですが面白そうです．
* Endlessh: an SSH Tarpit « null program
ということで手元で少し試してみました．
導入とビルド
$ git clone https://github.com/skeeto/endlessh
$ cd endlessh
$ git log |head -1
commit 548a7b1521b2912e7e133d0d9df50e0e514f1f2c
$ make
port 22222 で起動
$ ./endlessh -v -p22222 &
[1] 22698
2019-03-24T04:56:10.338Z Port 22222
2019-03-24T04:56:10.338Z Delay 10000
2019-03-24T04:56:10.338Z MaxLineLength 32
2019-03-24T04:56:10.338Z MaxClients 4096
ssh 接続してみると700分ほど捕まえていた
$ time ssh localhost -p 22222
2019-03-24T04:56:19.510Z ACCEPT host=::1 port=59402 fd=4 n=1/4096
ssh_exchange_identification: No banner received
real 700m30.650s
user 0m0.040s
sys 0m0.240s
2019-03-24T16:37:00.162Z CLOSE host=::1 port=59402 fd=4 time=42040.652 bytes=73944
終了
$ kill %1
[1]+ Done ./endlessh -v -p22222
数回試しましたが，標準オプションでは700分前後捕まりました．単にありもののscriptを動かすレベルの攻撃者であればツールが対応するまでは妨害になりそうです．
環境
$ git log |head -1
commit 548a7b1521b2912e7e133d0d9df50e0e514f1f2c
$ dpkg-query -W openssh-client
openssh-client 1:7.9p1-9
$ lsb_release -dr
Description: Debian GNU/Linux buster/sid
Release: unstable
$ uname -m
x86_64
matoken.org
May 5, 2025 at 9:01 PM
Endlessh を使って ssh 接続をとてもゆっくりと処理して攻撃者に嫌がらせをする – matoken's blog https://matoken.org/blog/2019/03/26/use-endlessh-to-handle-ssh-connections-very-slowly-and-harass-attackers/