How do I install and set up Endlessh on Ubuntu?

Clone the GitHub repository, run 'make' to compile the C program, and install with 'sudo make install'. Then configure via /etc/endlessh/config or command-line flags like -p for port and -d for delay, as outlined in the README.

Endlessh vs fail2ban for SSH protection: which should I use?

Endlessh is a tarpit that slowly wastes attackers' time by keeping connections open, while fail2ban actively blocks IPs after failed login attempts. Use Endlessh for lightweight deterrence and fail2ban for active blocking; they can be deployed together for layered security.

Does Endlessh work with IPv6 and how to enable it?

Yes, Endlessh supports IPv6 via the -6 command-line flag or by setting BindFamily to 6 in the configuration file. By default, it uses IPv4-mapped IPv6 to handle both address families.

How can I make Endlessh log to syslog for better monitoring?

Use the -s flag when running Endlessh to send log messages to syslog instead of standard output. This allows integration with centralized logging systems, as mentioned in the usage section.

What's the best port to run Endlessh on to protect my real SSH server?

Deploy Endlessh on a non-standard port like 2222 (default) and move your real SSH server to another port, such as a high-numbered one, to trap automated attacks before they reach production, as suggested in the README's philosophy.

Can Endlessh handle thousands of connections without crashing?

Up to a point—the MaxClients setting (default 4096) limits simultaneous connections, and the single-threaded poll() design is efficient, but under massive DDoS-like conditions, it might require tuning or additional scaling measures.

Endlessh — SSH Tarpit for Attackers

What is Endlessh?

Endlessh is an SSH tarpit that slowly sends an endless, random SSH banner to trap and waste the time of attackers attempting to brute-force SSH servers. It operates before cryptographic exchange occurs, keeping malicious clients connected indefinitely while protecting real SSH services. The tool is designed as a lightweight, single-threaded C program that can be deployed alongside production servers.

Target Audience

System administrators and security professionals looking to protect SSH servers from brute-force attacks and automated scanning tools. It's particularly useful for those managing internet-exposed servers who want to add an additional layer of defense.

Value Proposition

Endlessh provides a unique, resource-efficient approach to SSH security by wasting attackers' time without consuming significant system resources. Unlike traditional intrusion detection systems, it requires no cryptographic libraries and operates with minimal overhead while effectively neutralizing automated attacks.

SSH tarpit that slowly sends an endless banner

Use Cases

Best For

Protecting SSH servers from brute-force attacks
Trapping automated SSH scanning tools and bots
Reducing noise in server logs from failed login attempts
Adding a lightweight security layer to internet-exposed servers
Wasting resources of malicious actors with minimal system overhead
Deploying as a honeypot to study attack patterns

Not Ideal For

Deployments requiring immediate, authenticated SSH access for legitimate users
Systems needing active threat blocking or integration with intrusion prevention systems (IPS)
Environments where comprehensive, real-time logging and alerting for all attack attempts is mandatory

Pros & Cons

Pros

Minimalist Efficiency

Uses a single-threaded C program with poll() to handle multiple clients efficiently, keeping system overhead low as described in the README's design philosophy.

Zero Cryptographic Dependencies

Operates before SSH cryptographic exchange, eliminating the need for cryptographic libraries and reducing complexity, as highlighted in the key features.

Flexible Configuration

Allows tuning of delay, line length, client limits, and logging via command-line or config file, with examples provided in the README for adaptability.

Graceful Signal Handling

Supports signals like SIGTERM for clean shutdown, SIGHUP for config reload, and SIGUSR1 for connection stats, ensuring easy management as detailed in the usage section.

Cons

Complex Build on Niche Systems

The README admits that systems like RHEL 6, Solaris, and OpenBSD require extra linker flags or patches, complicating deployment and maintenance.

Passive Defense Only

Merely traps attackers without blocking, alerting, or integrating with other security tools, leaving systems vulnerable to persistent or multi-vector threats.

Scalability Constraints

Single-threaded design with a configurable MaxClients limit (default 4096) may bottleneck under extreme connection floods, despite using poll() for efficiency.

Frequently Asked Questions

What is Endlessh?

Target Audience

Value Proposition

Use Cases

Best For

Protecting SSH servers from brute-force attacks
Trapping automated SSH scanning tools and bots
Reducing noise in server logs from failed login attempts
Adding a lightweight security layer to internet-exposed servers
Wasting resources of malicious actors with minimal system overhead
Deploying as a honeypot to study attack patterns

Not Ideal For

Deployments requiring immediate, authenticated SSH access for legitimate users
Systems needing active threat blocking or integration with intrusion prevention systems (IPS)
Environments where comprehensive, real-time logging and alerting for all attack attempts is mandatory

Pros & Cons

Pros

Minimalist Efficiency

Uses a single-threaded C program with poll() to handle multiple clients efficiently, keeping system overhead low as described in the README's design philosophy.

Zero Cryptographic Dependencies

Operates before SSH cryptographic exchange, eliminating the need for cryptographic libraries and reducing complexity, as highlighted in the key features.

Flexible Configuration

Allows tuning of delay, line length, client limits, and logging via command-line or config file, with examples provided in the README for adaptability.

Graceful Signal Handling

Supports signals like SIGTERM for clean shutdown, SIGHUP for config reload, and SIGUSR1 for connection stats, ensuring easy management as detailed in the usage section.

Cons

Complex Build on Niche Systems

The README admits that systems like RHEL 6, Solaris, and OpenBSD require extra linker flags or patches, complicating deployment and maintenance.

Passive Defense Only

Merely traps attackers without blocking, alerting, or integrating with other security tools, leaving systems vulnerable to persistent or multi-vector threats.

Scalability Constraints

Single-threaded design with a configurable MaxClients limit (default 4096) may bottleneck under extreme connection floods, despite using poll() for efficiency.

Frequently Asked Questions

Endlessh

What is Endlessh?

Overview

Use Cases

Best For

Not Ideal For

Pros & Cons

Pros

Cons

Frequently Asked Questions

Related Projects

Found a gem we're missing?

Endlessh

What is Endlessh?

Overview

Use Cases

Best For

Not Ideal For

Pros & Cons

Pros

Cons

Frequently Asked Questions

Related Projects

Found a gem we're missing?