skeeto / endlessh Goto Github PK
View Code? Open in Web Editor NEWSSH tarpit that slowly sends an endless banner
License: The Unlicense
SSH tarpit that slowly sends an endless banner
License: The Unlicense
Error text:
# make
cc -ggdb3 -std=c99 -Wall -Wextra -Wno-missing-field-initializers -Os -o endlessh endlessh.c
endlessh.c: In function ‘main’:
endlessh.c:105: warning: dereferencing pointer ‘s’ does break strict-aliasing rules
endlessh.c:104: note: initialized from here
endlessh.c:110: warning: dereferencing pointer ‘s’ does break strict-aliasing rules
endlessh.c:109: note: initialized from here
/tmp/ccNO67G7.o: In function `uepoch':
/root/endlessh/endlessh.c:33: undefined reference to `clock_gettime'
collect2: ld returned 1 exit status
make: *** [endlessh] Error 1
In the Makefile, the following changes fixed the compile:
-LDFLAGS = -ggdb3
+LDFLAGS = -ggdb3 -lrt
endlessh
is a wonderful tool.
At the moment there are loglines like:
2020-02-03T13:30:38.268Z TOTALS connects=359 seconds=10691.941 bytes=12632
A clean stats interface would be better. Cutting the data out of the logs is not very smooth. Especially in a docker environment.
Additionally stats about a "CURRENT" state would be helpful too, like current connected clients.
I have used the provided systemd script, and go the error
● endlessh.service - Endlessh SSH Tarpit
Loaded: loaded (/etc/systemd/system/endlessh.service; disabled; vendor preset: enabled)
Active: activating (auto-restart) (Result: exit-code) since Wed 2020-12-02 21:20:58 CET; 4s ago
Docs: man:endlessh(1)
Process: 21332 ExecStart=/usr/local/bin/endlessh (code=exited, status=226/NAMESPACE)
Main PID: 21332 (code=exited, status=226/NAMESPACE)
Dec 02 21:20:58 raspi systemd[1]: endlessh.service: Failed with result 'exit-code'.
when I changed the line InaccessiblePaths=/run /var
to InaccessiblePaths=/run
it worked OK.
Not sure if this is a bug or just weird behaviour in raspberry pi.
I was using a build based on the 1.1 tag.
-- The start-up result is done.
Okt 24 12:38:29 monsterchen systemd[1]: Reloading.
Okt 24 12:41:00 monsterchen systemd[1]: Reloading.
Okt 24 12:41:07 monsterchen systemd[1]: Started Endlessh SSH Tarpit.
-- Subject: Unit endlessh.service has finished start-up
-- Defined-By: systemd
-- Support: https://access.redhat.com/support
--
-- Unit endlessh.service has finished starting up.
--
-- The start-up result is done.
Okt 24 12:41:07 monsterchen endlessh[1570]: 2020-10-24T10:41:07.138Z Port 22
Okt 24 12:41:07 monsterchen endlessh[1570]: 2020-10-24T10:41:07.138Z Delay 10000
Okt 24 12:41:07 monsterchen endlessh[1570]: 2020-10-24T10:41:07.138Z MaxLineLength 32
Okt 24 12:41:07 monsterchen endlessh[1570]: 2020-10-24T10:41:07.138Z MaxClients 4096
Okt 24 12:41:07 monsterchen endlessh[1570]: 2020-10-24T10:41:07.138Z BindFamily IPv4 Mapped IPv6
Okt 24 12:41:07 monsterchen endlessh[1570]: endlessh: fatal: Permission denied
Okt 24 12:41:07 monsterchen systemd[1]: endlessh.service: Main process exited, code=exited, status=1/FAILURE
Okt 24 12:41:07 monsterchen systemd[1]: endlessh.service: Failed with result 'exit-code'.
[root@monsterchen ~]# sestatus
SELinux status: disabled
Line 150-154 has the following:
logmsg(LOG_INFO, "TOTALS connects=%lld seconds=%lld.%lld bytes=%lld",
statistics.connects,
milliseconds / 1000,
milliseconds % 1000,
statistics.bytes_sent);
I think the format code for the milliseconds remainder should be %03lld
like line 135, right? Otherwise, e.g. 1005 milliseconds, will be printed as "seconds=1.5".
Nice project by the way! Very creative idea :)
There aren't that many option to use but the only option that you have at the time to see them is to use the example from the README.md.
It would be nice to have a reference inside the man page to an extra man page holding the information for the configuration.
I propose something similar to sshd_config
.
ie something like
User=nobody
Group=nobody
in Service section?
As in title, I think it would be beneficial to add support for AIPDB and similar sites.
The API is well documented and only would require the end user to supply their token.
I'm running with the systemd unit file as distributed.
In /etc/endlessh/config I have LogLevel 1.
Systemd file has (default) StandardOutput set to journal... yet journalctl records nothing upon start stop or connection. I tried setting to StandardOutput=file:/var/log/endlessh.log and StandardError the same, but nothing gets written.
If I start endlessh from a command line instead of the systemd unit with "endlessh -v >>/var/log/endlessh.log 2>>/var/log/endlessh.log" it does write to the log... but that doesn't help with running as a systemd unit.
I assume I'm missing something obvious, but how should I have this configured to monitor attempted connections/duration when running from a systemd file?
Hi @skeeto, I've noticed that many ssh-bots have figured out that Endlessh is at play on my honeypot. b/c client disconnect happens at almost exactly double the message delay (I have of course increased delay time but the behavior remains). Any way to randomize message delay (fx MaxDelay)?
current behavior examples: delay@10000 = [email protected] | delay@12543 = [email protected]
During install all I configured is :
sudo nano /etc/endlessh/config
Port 6000
```0
then it only listens on tcp6:
sudo netstat -ntulp | grep end
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp6 0 0 :::60000 :::* LISTEN 355519/endlessh
How can I also enable tcp4 too?
And why isn't default?
Right now, if LogLevel is 0, it doesn't output anything when signaled with USR1.
It looks like there's a typo in the repository description 😃
SSH tarpit that slowly sends
andan endless banner
When I'm trying to start endlessh i kepp getting a NAMEPSACE error. Is this only for Ubuntu or did i make anything wrong?
Thx
Sky
journalctl logs:
May 02 21:48:28 [REACTED] systemd[1]: Started Endlessh SSH Tarpit.
May 02 21:48:29 [REACTED] endlessh[16317]: endlessh.service: Failed at step NAMESPACE spawning /usr/local/bin/endlessh: No such file or directory
May 02 21:48:29 [REACTED] systemd[1]: endlessh.service: Main process exited, code=exited, status=226/NAMESPACE
May 02 21:48:29 [REACTED] systemd[1]: endlessh.service: Unit entered failed state.
May 02 21:48:29 [REACTED] systemd[1]: endlessh.service: Failed with result 'exit-code'.
right of the file:
-rwxr-xr-x 1 root root 128800 May 2 20:21 /usr/local/bin/endlessh
endlessh.service:
[Unit]
Description=Endlessh SSH Tarpit
Documentation=man:endlessh(1)
Requires=network-online.target
[Service]
Type=simple
Restart=always
RestartSec=30sec
ExecStart=/usr/local/bin/endlessh
KillSignal=SIGTERM
# Stop trying to restart the service if it restarts too many times in a row
StartLimitInterval=5min
StartLimitBurst=4
StandardOutput=journal
StandardError=journal
StandardInput=null
PrivateTmp=true
PrivateDevices=true
ProtectSystem=full
ProtectHome=true
InaccessiblePaths=/run /var
## If you want Endlessh to bind on ports < 1024
## 1) run:
## setcap 'cap_net_bind_service=+ep' /usr/local/bin/endlessh
## 2) uncomment following line
AmbientCapabilities=CAP_NET_BIND_SERVICE
## 3) comment following line
#PrivateUsers=true
NoNewPrivileges=true
ConfigurationDirectory=endlessh
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
MemoryDenyWriteExecute=true
[Install]
WantedBy=multi-user.target
With the command, it's work perfectly
If you have some idea ?
A very typical scenario would be running this on port 22, which requires elevated privilege on most Linux systems. Even considering the almost non-existent attack surface, running as root just for that seems awkward. Systemd provides a convenient mechanism of adding the capability of using privileged ports (<1024) to unprivileged services, called systemd sockets. A basic TCP socket would look like
[Unit]
Description=Endlessh socket
[Socket]
ListenStream=22
To take advantage of that, however, a program must be able to accept the input from that socket. There are two ways to do this, both mentioned in the linked article on sockets (either via systemd's native socket passing interface (see sd_listen_fds(3) for details) or via the traditional inetd(8)-style socket passing (i.e. sockets passed in via standard input and output, using StandardInput=socket in the service file)) I wonder if it is possible to add support for that to Endlessh.
How is the impact of endlessh if running behind a NAT router with port forwarding?
Especially on the router in this case, as the NAT router would have to monitor up to 4096 connections while the server behind it handles the "keeping clients busy" part.
An alternative I have would be to install endlessh on the NAT router, but for this I'd need a more recent "release" than 0.1, as that is hardly compatible with the package manager in use. So I would be grateful if the current state of endlessh could be tagged as a "release" version.
Hey guys, trying to install enablessh on my CentOS 8 server but I can't get it to the point where it autostarts it successfully.
On centos 7 everything works as expected.
Here is the log:
-- Logs begin at Tue 2021-02-23 16:46:05 CET, end at Tue 2021-02-23 16:48:15 CET. --
Feb 23 16:46:13 cloud-03 systemd[1]: Started Endlessh SSH Tarpit.
Feb 23 16:46:13 cloud-03 systemd[1]: endlessh.service: Main process exited, code=exited, status=203/EXEC
Feb 23 16:46:13 cloud-03 systemd[1]: endlessh.service: Failed with result 'exit-code'.
Feb 23 16:46:44 cloud-03 systemd[1]: endlessh.service: Service RestartSec=30s expired, scheduling restart.
Feb 23 16:46:44 cloud-03 systemd[1]: endlessh.service: Scheduled restart job, restart counter is at 1.
Feb 23 16:46:44 cloud-03 systemd[1]: Stopped Endlessh SSH Tarpit.
Feb 23 16:46:44 cloud-03 systemd[1]: Started Endlessh SSH Tarpit.
Feb 23 16:46:44 cloud-03 systemd[1]: endlessh.service: Main process exited, code=exited, status=203/EXEC
Feb 23 16:46:44 cloud-03 systemd[1]: endlessh.service: Failed with result 'exit-code'.
Feb 23 16:47:14 cloud-03 systemd[1]: endlessh.service: Service RestartSec=30s expired, scheduling restart.
Feb 23 16:47:14 cloud-03 systemd[1]: endlessh.service: Scheduled restart job, restart counter is at 2.
Feb 23 16:47:14 cloud-03 systemd[1]: Stopped Endlessh SSH Tarpit.
Feb 23 16:47:14 cloud-03 systemd[1]: Started Endlessh SSH Tarpit.
Feb 23 16:47:14 cloud-03 systemd[1]: endlessh.service: Main process exited, code=exited, status=203/EXEC
Feb 23 16:47:14 cloud-03 systemd[1]: endlessh.service: Failed with result 'exit-code'.
Feb 23 16:47:45 cloud-03 systemd[1]: endlessh.service: Service RestartSec=30s expired, scheduling restart.
Feb 23 16:47:45 cloud-03 systemd[1]: endlessh.service: Scheduled restart job, restart counter is at 3.
Feb 23 16:47:45 cloud-03 systemd[1]: Stopped Endlessh SSH Tarpit.
Feb 23 16:47:45 cloud-03 systemd[1]: Started Endlessh SSH Tarpit.
Feb 23 16:47:45 cloud-03 systemd[1]: endlessh.service: Main process exited, code=exited, status=203/EXEC
Feb 23 16:47:45 cloud-03 systemd[1]: endlessh.service: Failed with result 'exit-code'.
Feb 23 16:48:15 cloud-03 systemd[1]: endlessh.service: Service RestartSec=30s expired, scheduling restart.
Feb 23 16:48:15 cloud-03 systemd[1]: endlessh.service: Scheduled restart job, restart counter is at 4.
Feb 23 16:48:15 cloud-03 systemd[1]: Stopped Endlessh SSH Tarpit.
Feb 23 16:48:15 cloud-03 systemd[1]: endlessh.service: Start request repeated too quickly.
Feb 23 16:48:15 cloud-03 systemd[1]: endlessh.service: Failed with result 'exit-code'.
Feb 23 16:48:15 cloud-03 systemd[1]: Failed to start Endlessh SSH Tarpit.
this is my service file:
[root@cloud-03 ~]# cat /etc/systemd/system/endlessh.service
[Unit]
Description=Endlessh SSH Tarpit
Documentation=man:endlessh(1)
Requires=network-online.target
[Service]
Type=simple
Restart=always
RestartSec=30sec
ExecStart=/usr/local/bin/endlessh
KillSignal=SIGTERM
# Stop trying to restart the service if it restarts too many times in a row
StartLimitInterval=5min
StartLimitBurst=4
StandardOutput=journal
StandardError=journal
StandardInput=null
PrivateTmp=true
PrivateDevices=true
ProtectSystem=full
ProtectHome=true
InaccessiblePaths=/run /var
## If you want Endlessh to bind on ports < 1024
## 1) run:
## setcap 'cap_net_bind_service=+ep' /usr/local/bin/endlessh
## 2) uncomment following line
AmbientCapabilities=CAP_NET_BIND_SERVICE
## 3) comment following line
#PrivateUsers=true
NoNewPrivileges=true
ConfigurationDirectory=endlessh
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
MemoryDenyWriteExecute=true
[Install]
WantedBy=multi-user.target
And this is my config file:
[root@cloud-03 ~]# cat /etc/endlessh/config
Port 22
Thank you for your work! Sure feels good to know that bots will be endlessly stuck in the tarpit!
Would you be open for a PR that adds a GitHub action publishing the docker image in GitHubs Container Registry? I'd be happy to help setting that up.
When trying to make on Ubuntu, I get these errors:
root@hackme:~/endlessh# ls
Dockerfile endlessh.1 endlessh.c Makefile README.md UNLICENSE util
root@hackme:~/endlessh# make
cc -std=c99 -Wall -Wextra -Wno-missing-field-initializers -Os -ggdb3 -o endlessh endlessh.c
make: cc: Command not found
Makefile:12: recipe for target 'endlessh' failed
make: *** [endlessh] Error 127
root@hackme:~/endlessh# make LDLIBS=-lrt
cc -std=c99 -Wall -Wextra -Wno-missing-field-initializers -Os -ggdb3 -o endlessh endlessh.c -lrt
make: cc: Command not found
Makefile:12: recipe for target 'endlessh' failed
make: *** [endlessh] Error 127
root@hackme:~/endlessh# make CC=gcc LDLIBS='-lnsl -lrt -lsocket'
gcc -std=c99 -Wall -Wextra -Wno-missing-field-initializers -Os -ggdb3 -o endlessh endlessh.c -lnsl -lrt -lsocket
make: gcc: Command not found
Makefile:12: recipe for target 'endlessh' failed
make: *** [endlessh] Error 127
root@hackme:~/endlessh# lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 18.04.5 LTS
Release: 18.04
Codename: bionic
root@hackme:~/endlessh#
libc6-dev
is installed.
Any advice?
Pacstall is a community-driven AUR-like package manager for Ubuntu. We have an ongoing pull request to add Endlessh to our repository.
We have a few questions for you:
I am trying to get this to run in a raspbian system. If I start the application on it's own it works fine, but by trying to make it run throught systemctl I get this:
ExecStart=/usr/local/bin/endlessh (code=exited, status=226/NAMESPACE)
I followed the endlessh.service instructions to run it in a port under 1028, which initially I failed to follow, but I still get the same result.
Tried the endlessh v1.1 package, available with UBUNTU 20.04 LTS Server.
Ran into several problems:
man page mentions default config file, which is missing out of the box.
no endlessh-doc package available so cant lookup further docs or readme's
My Server has multiple interfaces and ip addresses. Therefor i configured the sshd to listen to very specific Interfaces/IPs and Ports . On "internal" interfaces/IPs it listens to standard port 22/tcp. On external interfaces/IPs it listens to a non-standard tcp port.
That means i am unable to run/start entlessh on plain port 22, since it is "in use" on some interfaces/IP addresses, since there seems no option to configure it like the sshd
Here is a partial example sshd conf:
ListenAddress 0.0.0.0:65000
ListenAddress [::]:65000
ListenAddress [::1]:22
ListenAddress 127.0.0.1:22
ListenAddress [fd00:dead:beef:cafe::1]:22
ListenAddress 192.168.0.1:22
Would be cool if endlessh could be configured just like sshd and that it would not bind just to all IPs with one single port.
MANY THANKS for all the work and effort so far!
best wishes
Axel
Hello, I wanted to ask if Debian support is planned?
Greetings Christopher
Hello.
I'm having a similar to issue 66 and 53, but I can't figure out a solution by myself.
Running Debian 12. Installed endlessh using the apt package manager, i.e. apt install endlessh
Config files and the endless program itself don't seem to be installed in the same directories as per the documentation (presumably because it was installed with the Debian package manager). Finding documentation for Debian specifically is ...challenging.
sudo endlessh -v -p 22
...works perfectly fine. I can attempt to log in from another machine and I can't get access, as expected.
I then tried to create the config file, log file, and error file in a folder in my user directory, i.e.:
mkdir /home/david/endlessh
touch /home/david/endlessh/config
touch /home/david/endlessh/endlessh.log
touch /home/david/endlessh/endlessh.err
I then copied the sample configuration file contents from your documentation into /home/david/endlessh/config, except I changed to port 22 and LogLevel to 1. Otherwise, the config file is identical.
systemctl status endlessh
shows the .service file is located at /lib/systemd/system/endlessh.service.
sudo nano /lib/systemd/system/endlessh.service
I then changed the ExecStart line to:
ExecStart=/usr/bin/endlessh -f /home/david/endlessh/config -v > /home/david/endlessh/endlessh.log 2> /home/david/endlessh/endlessh.err
The entire contents of /lib/systemd/system/endlessh.service is:
[Unit]
Description=Endlessh SSH Tarpit
Documentation=man:endlessh(1)
Requires=network-online.target
[Service]
Type=simple
Restart=always
RestartSec=30sec
ExecStart=/usr/bin/endlessh -f /home/david/endlessh/config -v > /home/david/endlessh/endlessh.log 2> /home/david/endlessh/endlessh.err
KillSignal=SIGTERM
# Stop trying to restart the service if it restarts too many times in a row
StartLimitInterval=5min
StartLimitBurst=4
StandardOutput=journal
StandardError=journal
StandardInput=null
PrivateTmp=true
PrivateDevices=true
ProtectSystem=full
ProtectHome=true
#InaccessiblePaths=/run /var
## If you want Endlessh to bind on ports < 1024
## 1) run:
## setcap 'cap_net_bind_service=+ep' /usr/local/bin/endlessh
## 2) uncomment following line
#AmbientCapabilities=CAP_NET_BIND_SERVICE
## 3) comment following line
PrivateUsers=true
NoNewPrivileges=true
ConfigurationDirectory=endlessh
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
MemoryDenyWriteExecute=true
[Install]
WantedBy=multi-user.target
(Note I have tried this both with and without the InaccessiblePaths=/run /var
line being commented-out, but both times I had the same issue)
I then ran sudo systemctl --now enable endlessh
. The stdout was:
Synchronizing state of endlessh.service with SysV service script with /lib/systemd/systemd-sysv-install.
Executing: /lib/systemd/systemd-sysv-install enable endlessh
I then ran systemctl status endlessh. The first time, the stdout contained "status=226/NAMESPACE". I went Googling and found the above-mentioned issues 53 and 66. They advised to comment-out the InaccessiblePaths
line. Then I tried sudo systemctl --now enable endlessh
again, with the following stdout:
● endlessh.service - Endlessh SSH Tarpit
Loaded: loaded (/lib/systemd/system/endlessh.service; enabled; preset: enabled)
Active: activating (auto-restart) (Result: exit-code) since Fri 2024-07-12 11:53:40 AEST; 76ms ago
Docs: man:endlessh(1)
Process: 37873 ExecStart=/usr/bin/endlessh -f /home/david/endlessh/config -v > /home/david/endlessh/endlessh.log 2> /home/david/endlessh/endlessh.err (code=exited, status=1/FAILURE)
Main PID: 37873
I also tried a system reboot at this point, just in case something wasn't working properly and needed to be restarted, but again, I ended up with the same error message as above.
If I try to run sudo endlessh -v > /home/david/endlessh/endlessh.log 2> /home/david/endlessh/endlessh.err
manually, it works perfectly, and the file at /home/david/endlessh/endlessh.log is populated with log lines (but obviously this is not running as a service in the background, so isn't ideal).
Any idea what I'm doing wrong please?
Thanks.
P.S.: I'm a noob when it comes to services, so I'm assuming PEBKAC...
Hi,
it would be nice if the service will be recognized as a regular OpenSSH server when scanned with Nmap.
At the moment, the output is:
nmap -T4 -sS -sV --reason -v -p 2222 --send-ip localhost 0|14:38:42
Starting Nmap 7.70 ( https://nmap.org ) at 2019-03-25 14:38 CET
NSE: Loaded 43 scripts for scanning.
Initiating SYN Stealth Scan at 14:38
Scanning localhost (127.0.0.1) [1 port]
Discovered open port 2222/tcp on 127.0.0.1
Completed SYN Stealth Scan at 14:38, 0.03s elapsed (1 total ports)
Initiating Service scan at 14:38
Scanning 1 service on localhost (127.0.0.1)
Completed Service scan at 14:41, 151.12s elapsed (1 service on 1 host)
NSE: Script scanning 127.0.0.1.
Initiating NSE at 14:41
Completed NSE at 14:41, 0.01s elapsed
Initiating NSE at 14:41
Completed NSE at 14:41, 1.02s elapsed
Nmap scan report for localhost (127.0.0.1)
Host is up, received localhost-response (0.000045s latency).
Other addresses for localhost (not scanned): ::1
PORT STATE SERVICE REASON VERSION
2222/tcp open EtherNetIP-1? syn-ack ttl 64
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port2222-TCP:V=7.70%I=7%D=3/25%Time=5C98D9EF%P=x86_64-pc-linux-gnu%r(NU
SF:LL,6,"\+EwB\r\n")%r(GenericLines,6,"\+EwB\r\n")%r(GetRequest,E,"zb-mT\?
SF:&\)\.\?A2\r\n")%r(RTSPRequest,10,"k}6\*IZ/\\7SXZ!@\r\n")%r(DNSVersionBi
SF:ndReqTCP,7,"@nkHd\r\n")%r(Help,1D,"-\(asQy!#,r\\IalJ,dWp9i>Zc-Ou\r\n")%
SF:r(TLSSessionReq,12,"RX9yPFnKv3\^MJypE\r\n")%r(FourOhFourRequest,20,"c-\
SF:.>jnD;Gb\[dj53B=\^y6Gy`H>xn}\)`\r\n")%r(SIPOptions,C,"m3aM;w#FB\$\r\n")
SF:%r(TerminalServer,8,"\.z\*en~\r\n")%r(NotesRPC,10,"LN}w\|,\^KUc,LB}\r\n
SF:")%r(WMSRequest,C,"!H4Py\(Yc!U\r\n")%r(giop,1D,"rw!k\x20@2#2pt\+>qC2\.5
SF:c;nq-fM2w\r\n");
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 152.59 seconds
Raw packets sent: 1 (44B) | Rcvd: 2 (88B)
A simple test shows that sending an initial banner with a default OpenSSH response does the trick:
echo 'SSH-2.0-OpenSSH_7.9p1 Debian-9' | nc -lvvp 2222
This will result in the following Nmap output:
nmap -T4 -sS -sV --reason -v -p 2222 --send-ip localhost 0|14:41:21
Starting Nmap 7.70 ( https://nmap.org ) at 2019-03-25 14:48 CET
NSE: Loaded 43 scripts for scanning.
Initiating SYN Stealth Scan at 14:48
Scanning localhost (127.0.0.1) [1 port]
Discovered open port 2222/tcp on 127.0.0.1
Completed SYN Stealth Scan at 14:48, 0.03s elapsed (1 total ports)
Initiating Service scan at 14:48
Scanning 1 service on localhost (127.0.0.1)
Completed Service scan at 14:48, 0.00s elapsed (1 service on 1 host)
NSE: Script scanning 127.0.0.1.
Initiating NSE at 14:48
Completed NSE at 14:48, 0.00s elapsed
Initiating NSE at 14:48
Completed NSE at 14:48, 0.00s elapsed
Nmap scan report for localhost (127.0.0.1)
Host is up, received localhost-response (0.000036s latency).
Other addresses for localhost (not scanned): ::1
PORT STATE SERVICE REASON VERSION
2222/tcp open ssh syn-ack ttl 64 OpenSSH 7.9p1 Debian 9 (protocol 2.0)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 0.41 seconds
Raw packets sent: 1 (44B) | Rcvd: 2 (88B)
Hey guys, not a bug but an announcement really.
We, LinuxServer.io, just released a multi-arch docker image (x86_64, arm32v7 and arm64v8) for Endlessh, pushed to Docker Hub, GHCR and Gitlab.
The readme is here: https://github.com/linuxserver/docker-endlessh
In a nutshell, you can run it as a stateless container, configured via env vars, logging to container log. You can also have it log to file if you want to pair it with fail2ban (not included).
The endlessh process runs as an unprivileged user inside the container and it listens on port 2222, but you can map that to any port on the host (including 22). The image gets weekly OS package updates, and will automatically build and push any commits to the master repo here.
Enjoy!
PS. Thanks @skeeto for the code. We included the donation link for https://secure.givewell.org/ in the container log and in the Github sponsors button based on your blog entry about it. We hope that's OK.
fprintf(f, " -v Print version information and exit\n");
Here, should be -V
instead of -v
.
By the way, could you please add a feature of trying save the connected clients' IP to a file?
When trying to start endlessh on port 22, on a machine using systemd,
the service fails to start due to getting EACCESS
on the bind(2)
call
to open the socket.
As endlessh
only reports fatal: Permission denied
, I took a recording
of the process' activity under strace
, running as the systemd service:
Jan 30 22:19:10 neon.citronna.de systemd[1]: Started Endlessh SSH Tarpit.
Jan 30 22:19:10 neon.citronna.de strace[2060944]: execve("/usr/bin/endlessh", ["/usr/bin/endlessh", "-p22"], 0x7ffe5c745d68 /* 5 vars */) = 0
Jan 30 22:19:10 neon.citronna.de strace[2060944]: brk(NULL) = 0x55809d08c000
[loading libraries...]
Jan 30 22:19:10 neon.citronna.de strace[2060944]: openat(AT_FDCWD, "/etc/endlessh/config", O_RDONLY) = -1 ENOENT (No such file or directory)
Jan 30 22:19:10 neon.citronna.de strace[2060944]: rt_sigaction(SIGPIPE, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=SA_RESTORER|SA_INTERRUPT|SA_NODEFER|SA_RESETHAND, sa_restorer=0x7f5f98187100}, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, 8) = 0
Jan 30 22:19:10 neon.citronna.de strace[2060944]: rt_sigaction(SIGTERM, {sa_handler=0x55809b5eddd0, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f5f98187100}, NULL, 8) = 0
Jan 30 22:19:10 neon.citronna.de strace[2060944]: rt_sigaction(SIGHUP, {sa_handler=0x55809b5edde0, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f5f98187100}, NULL, 8) = 0
Jan 30 22:19:10 neon.citronna.de strace[2060944]: rt_sigaction(SIGUSR1, {sa_handler=0x55809b5eddf0, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f5f98187100}, NULL, 8) = 0
[we are now in server_create]
Jan 30 22:19:10 neon.citronna.de strace[2060944]: socket(AF_INET6, SOCK_STREAM, IPPROTO_IP) = 3
Jan 30 22:19:10 neon.citronna.de strace[2060944]: setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0
Jan 30 22:19:10 neon.citronna.de strace[2060944]: setsockopt(3, SOL_IPV6, IPV6_V6ONLY, [0], 4) = 0
Jan 30 22:19:10 neon.citronna.de strace[2060944]: bind(3, {sa_family=AF_INET6, sin6_port=htons(22), inet_pton(AF_INET6, "::", &sin6_addr), sin6_flowinfo=htonl(0), sin6_scope_id=0}, 28) = -1 EACCES (Permission denied)
[BOOM!]
Jan 30 22:19:10 neon.citronna.de strace[2060944]: write(2, "endlessh: fatal: Permission deni"..., 35
Jan 30 22:19:10 neon.citronna.de systemd[1]: endlessh.service: Main process exited, code=exited, status=1/FAILURE
Jan 30 22:19:10 neon.citronna.de strace[2060949]: write(2, "endlessh: fatal: Permissi
Jan 30 22:19:10 neon.citronna.de strace[2060944]: write(2, "endlessh: fatal: Permissi
Jan 30 22:19:10 neon.citronna.de strace[2060944]: = 35
Jan 30 22:19:10 neon.citronna.de systemd[1]: endlessh.service: Failed with result 'exit-code'.
Jan 30 22:19:10 neon.citronna.de strace[2060944]: exit_group(1)
Jan 30 22:19:28 neon.citronna.de systemd[1]: Stopped Endlessh SSH Tarpit.
I was unable to find immediately what causes this, though I expect it is related
to the security-related settings in endless.service
.
I didn't search very hard, though, as I have a more satisfying solution via
socket activation...
Hi, it is possible to add such thing as bind to interface/IP and IP whitelist? Also will be nice to bind on multiple ifaces/IPs/ports
Thanks!
Lintian (the Debian package linter) reports a syntax issue in the manpage, but I'm incapable of narrowing it down to a specific issue (it's 2.30am here, I'm not dealing with troff...)
I installed version 1.1-2 via apt on Ubuntu 20.04.
after install, there is only an empty folder /etc/endlessh
I added your config example from the Readme, changed the port to 2223 and restarted the service, but still there is no effect on that port when trying ssh -p 2223
Hi,
Thanks for the awesome program. I'm running
endlessh -4 -d 10000 -p 22 -v -l 32
and as soon as I hit enter, port 22 starts accepting connections, but no banner is received on the client side. It just hangs. Is that a normal behavior?
Regards,
Thiago
I was happy to see that it contained a Dockerfile... but what should I name the config-file?
Lines 790 to 797 in 715f30c
Effort's made to detect a NULL client, but it's then inserted into the fifo and dereferenced to log its acceptance anyway.
It would be cool if endlessh could read the header data to send from a file before falling back to random data. That way the ssh tarpit would look more official before falling back to random data.
Not to mention sending some cool ASCII art headers would probably keep human attackers on the line for longer.
endlessh> make
cc -ggdb3 -std=c99 -Wall -Wextra -Wno-missing-field-initializers -Os -o endlessh endlessh.c
endlessh.c:705:55: error: use of undeclared identifier 'MSG_DONTWAIT'
ssize_t out = send(fd, line, len, MSG_DONTWAIT);
^
1 error generated.
*** Error code 1
Stop.
Nice idea - thanks for endlessh!
I just installed it in a FreeBSD jail. Unfortunately, it listens only on the IPv6 address. Is there a way of letting it listen also on the IPv4 address of the jail?
If I install endlessh through apt install endlessh
then the command setcap 'cap_net_bind_service=+ep' /usr/local/bin/endlessh
does not work and I get
Failed to set capabilities on file
/usr/local/bin/endlessh' (No such file or directory) The value of the capability argument is not permitted for a file. Or the file is not a regular (non-symlink) file`
And there is only a empty endlessh.service in /etc/systemd/system/
Instead the non-empty endlessh.service file is in /lib/systemd/system/
I can see that the logs are coming out in UTC, can we use the system local time instead, or maybe add a flag to enable this?
cc -ggdb3 -std=c99 -Wall -Wextra -Wno-missing-field-initializers -Os -o endlessh endlessh.c
cc: Warning: Option -db3 passed to ld, if ld is invoked, ignored otherwise
cc: Warning: Option -Os passed to ld, if ld is invoked, ignored otherwise
"/usr/include/sys/feature_tests.h", line 337: #error: "Compiler or options invalid for pre-UNIX 03 X/Open applications and pre-2001 POSIX applications"
cc: acomp failed for endlessh.c
make: *** [Makefile:8: endlessh] Error 2
cc on Solaris is Oracle Developer Studio.
When change to gcc, got different errors:
# make
gcc -ggdb3 -std=c99 -Wall -Wextra -Wno-missing-field-initializers -Os -o endlessh endlessh.c
In file included from /usr/include/time.h:18:0,
from endlessh.c:20:
/opt/csw/lib/gcc/i386-pc-solaris2.10/5.5.0/include-fixed/sys/feature_tests.h:346:2: error: #error "Compiler or options invalid for pre-UNIX 03 X/Open applications and pre-2001 POSIX applications"
#error "Compiler or options invalid for pre-UNIX 03 X/Open applications \
^
In file included from /usr/include/sys/vnode.h:44:0,
from /usr/include/sys/stream.h:21,
from /usr/include/netinet/in.h:65,
from /usr/include/sys/socket.h:44,
from endlessh.c:32:
/usr/include/sys/resource.h:146:17: error: field 'ru_utime' has incomplete type
struct timeval ru_utime; /* user time used */
^
/usr/include/sys/resource.h:147:17: error: field 'ru_stime' has incomplete type
struct timeval ru_stime; /* system time used */
^
endlessh.c:152:8: error: redefinition of 'struct queue'
struct queue {
^
In file included from /usr/include/netinet/in.h:65:0,
from /usr/include/sys/socket.h:44,
from endlessh.c:32:
/usr/include/sys/stream.h:66:16: note: originally defined here
typedef struct queue {
^
endlessh.c: In function 'config_load':
endlessh.c:419:16: warning: implicit declaration of function 'getline' [-Wimplicit-function-declaration]
while (getline(&line, &len, f) != -1) {
^
endlessh.c: In function 'main':
endlessh.c:566:22: warning: implicit declaration of function 'getopt' [-Wimplicit-function-declaration]
while ((option = getopt(argc, argv, "d:f:hl:m:p:vV")) != -1) {
^
endlessh.c:569:43: error: 'optarg' undeclared (first use in this function)
config_set_delay(&config, optarg, 1);
^
endlessh.c:569:43: note: each undeclared identifier is reported only once for each function it appears in
endlessh.c:602:14: error: 'optind' undeclared (first use in this function)
if (argv[optind]) {
^
make: *** [Makefile:8: endlessh] Error 1
I'm about to run Endlessh on port 22, for which I need to run it as root to be able to bind to it. While it doesn't read anything from the clients, so exploiting it would be quite a challenge, I'm still uneasy running things as root, long-term, if I can avoid it.
Would it be possible to drop privileges once bound to the port, if running as root? Perhaps even chroot into an empty dir too?
I can prepare a pull request for both, if the idea is acceptable to you.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.