An SSH tarpit that slowly sends an endless banner to trap and waste attackers' time.
Endlessh is an SSH tarpit that slowly sends an endless, random SSH banner to trap and waste the time of attackers attempting to brute-force SSH servers. It operates before cryptographic exchange occurs, keeping malicious clients connected indefinitely while protecting real SSH services. The tool is designed as a lightweight, single-threaded C program that can be deployed alongside production servers.
System administrators and security professionals looking to protect SSH servers from brute-force attacks and automated scanning tools. It's particularly useful for those managing internet-exposed servers who want to add an additional layer of defense.
Endlessh provides a unique, resource-efficient approach to SSH security by wasting attackers' time without consuming significant system resources. Unlike traditional intrusion detection systems, it requires no cryptographic libraries and operates with minimal overhead while effectively neutralizing automated attacks.
SSH tarpit that slowly sends an endless banner
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Uses a single-threaded C program with poll() to handle multiple clients efficiently, keeping system overhead low as described in the README's design philosophy.
Operates before SSH cryptographic exchange, eliminating the need for cryptographic libraries and reducing complexity, as highlighted in the key features.
Allows tuning of delay, line length, client limits, and logging via command-line or config file, with examples provided in the README for adaptability.
Supports signals like SIGTERM for clean shutdown, SIGHUP for config reload, and SIGUSR1 for connection stats, ensuring easy management as detailed in the usage section.
The README admits that systems like RHEL 6, Solaris, and OpenBSD require extra linker flags or patches, complicating deployment and maintenance.
Merely traps attackers without blocking, alerting, or integrating with other security tools, leaving systems vulnerable to persistent or multi-vector threats.
Single-threaded design with a configurable MaxClients limit (default 4096) may bottleneck under extreme connection floods, despite using poll() for efficiency.