{"id":30312,"date":"2019-10-31T21:34:49","date_gmt":"2019-10-31T18:34:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/lovushka-tarpit-dlya-vhodyashhih-ssh-soedinenij\/"},"modified":"2019-10-31T21:34:49","modified_gmt":"2019-10-31T18:34:49","slug":"lovushka-tarpit-dlya-vhodyashhih-ssh-soedinenij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/lovushka-tarpit-dlya-vhodyashhih-ssh-soedinenij","title":{"rendered":"L\u00e1kadlo (tarpit) pro p\u0159\u00edchoz\u00ed SSH p\u0159ipojen\u00ed","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Nen\u00ed tajemstv\u00edm, \u017ee internet je velmi nep\u0159\u00e1telsk\u00e9 prost\u0159ed\u00ed. Jakmile spust\u00edte server, okam\u017eit\u011b se vystavujete intenzivn\u00edm \u00fatok\u016fm a mno\u017estv\u00ed skenov\u00e1n\u00ed. Na p\u0159\u00edkladu honeypota od bezpe\u010dnostn\u00edch expert\u016f<\/a><\/noindex> m\u016f\u017eeme posoudit rozsah tohoto odpadkov\u00e9ho provozu. Ve skute\u010dnosti m\u016f\u017ee na pr\u016fm\u011brn\u00e9m serveru b\u00fdt 99 % provozu \u0161kodliv\u00e9.<\/p>\n

Tarpit je portov\u00e1 past, kter\u00e1 se pou\u017e\u00edv\u00e1 ke zpomalen\u00ed p\u0159\u00edchoz\u00edch spojen\u00ed. Pokud se t\u0159et\u00ed syst\u00e9m p\u0159ipoj\u00ed k tomuto portu, rychle uzav\u0159\u00edt spojen\u00ed nebude mo\u017en\u00e9. Bude muset vy\u010derpat sv\u00e9 syst\u00e9mov\u00e9 zdroje a \u010dekat, a\u017e spojen\u00ed nebude p\u0159eru\u0161eno kv\u016fli timeoutu, nebo ho manu\u00e1ln\u011b p\u0159eru\u0161it.<\/p>\n

Nej\u010dast\u011bji se tarpity pou\u017e\u00edvaj\u00ed na ochranu. Tato technika byla poprv\u00e9 vyvinuta k ochran\u011b proti po\u010d\u00edta\u010dov\u00fdm \u010derv\u016fm. A nyn\u00ed ji lze vyu\u017e\u00edt k znep\u0159\u00edjemn\u011bn\u00ed \u017eivota spammer\u016fm a v\u00fdzkumn\u00edk\u016fm, kte\u0159\u00ed se v\u011bnuj\u00ed rozs\u00e1hl\u00e9mu skenov\u00e1n\u00ed v\u0161ech IP adres za sebou (p\u0159\u00edklady na Habr: Rakousko<\/a><\/noindex>, Ukrajina<\/a><\/noindex>).
\n<\/a><\/noindex>
\nJednomu z administr\u00e1tor\u016f, jm\u00e9nem Chris Wellons, z\u0159ejm\u011b p\u0159estalo bavit sledovat tuto nepo\u0159\u00e1dek \u2014 a napsal mal\u00fd program Endlessh<\/a><\/noindex>, tarpity pro SSH, kter\u00fd zpomaluje p\u0159\u00edchoz\u00ed spojen\u00ed. Program otev\u0159e port (ve v\u00fdchoz\u00edm nastaven\u00ed je pro testov\u00e1n\u00ed uveden port 2222) a tv\u00e1\u0159\u00ed se jako SSH server, ale ve skute\u010dnosti vytv\u00e1\u0159\u00ed nekone\u010dn\u00e9 spojen\u00ed s p\u0159\u00edchoz\u00edm klientem, dokud se nevzd\u00e1. To m\u016f\u017ee trvat n\u011bkolik dn\u00ed nebo d\u00e9le, dokud klient nevypadne.<\/p>\n

Instalace utility:<\/p>\n

$ make\n$ .\/endlessh &\n$ ssh -p2222 localhost<\/code><\/pre>\n
\nSpr\u00e1vn\u011b implementovan\u00fd tarpity odebere \u00fato\u010dn\u00edkovi v\u00edce zdroj\u016f ne\u017e v\u00e1m. Ale jde nejen o zdroje. Autor p\u00ed\u0161e<\/a><\/noindex>, \u017ee program vyvol\u00e1v\u00e1 z\u00e1vislost. Pr\u00e1v\u011b te\u010f m\u00e1 v jeho pasti 27 klient\u016f, n\u011bkte\u0159\u00ed jsou p\u0159ipojeni po t\u00fddny. V \u0161pi\u010dce aktivity bylo v pasti 1378 klient\u016f po dobu 20 hodin!<\/p>\n
V provozn\u00edm re\u017eimu je t\u0159eba server Endlessh um\u00edstit na b\u011b\u017en\u00fd port 22, na kter\u00fd masivn\u011b \u00fato\u010d\u00ed zlod\u011bji. Standardn\u00ed bezpe\u010dnostn\u00ed doporu\u010den\u00ed v\u017edy rad\u00ed p\u0159esunout SSH na jin\u00fd port, co\u017e okam\u017eit\u011b v\u00fdrazn\u011b zkracuje velikost log\u016f.<\/p>\n
Chris Wellons \u0159\u00edk\u00e1, \u017ee jeho program vyu\u017e\u00edv\u00e1 jeden odstavec ze specifikace RFC 4253<\/a><\/noindex> o protokolu SSH. Ihned po nav\u00e1z\u00e1n\u00ed spojen\u00ed TCP, ale p\u0159ed pou\u017eit\u00edm kryptografie, by se ob\u011b strany m\u011bly poslat identifika\u010dn\u00ed \u0159et\u011bzec. A tam je tak\u00e9 pozn\u00e1mka: \u201eServer m\u016f\u017ee poslat dal\u0161\u00ed \u0159\u00e1dky dat p\u0159ed odesl\u00e1n\u00edm \u0159\u00e1dku s verz\u00ed\u201c<\/i>. A \u017e\u00e1dn\u00e9 omezen\u00ed<\/b> na objem t\u011bchto dat, pouze ka\u017ed\u00fd \u0159\u00e1dek by m\u011bl za\u010d\u00ednat s SSH-<\/code>.<\/p>\n
T\u00edmto se zab\u00fdv\u00e1 program Endlessh: vytv\u00e1\u0159\u00ed odes\u00edl\u00e1 nekone\u010dn\u00fd<\/i> tok n\u00e1hodn\u011b generovan\u00fdch dat<\/b>, kter\u00e9 odpov\u00eddaj\u00ed RFC 4253, to znamen\u00e1, \u017ee jsou odes\u00edl\u00e1ny p\u0159ed identifikac\u00ed, a ka\u017ed\u00fd \u0159\u00e1dek za\u010d\u00edn\u00e1 s SSH-<\/code> a nep\u0159esahuje 255 znak\u016f v\u010detn\u011b koncov\u00e9ho znaku \u0159\u00e1dku. Celkov\u011b je to v souladu se standardem.<\/p>\n
Ve defaultn\u00edm nastaven\u00ed program \u010dek\u00e1 10 sekund mezi odes\u00edl\u00e1n\u00edm paket\u016f. To zabra\u0148uje odpojen\u00ed kv\u016fli timeoutu, tak\u017ee klient z\u016fstane uv\u011bzn\u011bn nav\u017edy.<\/p>\n
Proto\u017ee odes\u00edl\u00e1n\u00ed dat prob\u00edh\u00e1 p\u0159ed aplikac\u00ed \u0161ifrov\u00e1n\u00ed, je program v\u00fdjime\u010dn\u011b jednoduch\u00fd. Nen\u00ed t\u0159eba implementovat \u017e\u00e1dn\u00e9 \u0161ifry a podporu mnoha protokol\u016f.<\/p>\n
Autor se sna\u017eil, aby utilita spot\u0159ebov\u00e1vala minimum zdroj\u016f a fungovala zcela nen\u00e1padn\u011b na stroji. Na rozd\u00edl od modern\u00edch antivir\u016f a jin\u00fdch \u201abezpe\u010dnostn\u00edch syst\u00e9m\u016f\u2018 by nem\u011bla zpomalovat po\u010d\u00edta\u010d. Poda\u0159ilo se minimalizovat jak provoz, tak i spot\u0159ebu pam\u011bti d\u00edky trochu chyt\u0159ej\u0161\u00ed programov\u00e9 implementaci. Kdyby prost\u011b spou\u0161t\u011bl samostatn\u00fd proces na nov\u00e9 spojen\u00ed, potenci\u00e1ln\u00ed \u00fato\u010dn\u00edci by mohli prov\u00e9st DDoS \u00fatok otev\u0159en\u00edm mnoha spojen\u00ed k vy\u010derp\u00e1n\u00ed zdroj\u016f na stroji. Jeden tok na spojen\u00ed \u2014 tak\u00e9 nen\u00ed nejlep\u0161\u00ed varianta, proto\u017ee j\u00e1dro by pl\u00fdtvalo zdroji na spr\u00e1vu tok\u016f.<\/p>\n
Proto Chris Vellons zvolil pro Endlessh nejleh\u010d\u00ed variantu: jednovl\u00e1knov\u00fd server poll(2)<\/code>, kde klienti v pasti prakticky nepou\u017e\u00edvaj\u00ed \u017e\u00e1dn\u00e9 dal\u0161\u00ed zdroje, krom\u011b objektu socketu v j\u00e1d\u0159e a je\u0161t\u011b 78 byt\u016f pro sledov\u00e1n\u00ed v Endlessh. Aby nemuseli alokovat vyrovn\u00e1vac\u00ed pam\u011bti pro p\u0159\u00edjem a odes\u00edl\u00e1n\u00ed pro ka\u017ed\u00e9ho klienta, Endlessh otv\u00edr\u00e1 socket p\u0159\u00edm\u00e9ho p\u0159\u00edstupu a p\u0159\u00edmo p\u0159en\u00e1\u0161\u00ed TCP pakety, t\u00e9m\u011b\u0159 ignoruje cel\u00fd TCP\/IP stack opera\u010dn\u00edho syst\u00e9mu. P\u0159ich\u00e1zej\u00edc\u00ed buffer v\u016fbec nen\u00ed pot\u0159eba, proto\u017ee p\u0159\u00edchoz\u00ed data n\u00e1s nezaj\u00edmaj\u00ed.<\/p>\n
Autor \u0159\u00edk\u00e1, \u017ee v dob\u011b vytv\u00e1\u0159en\u00ed sv\u00e9 aplikace nev\u011bd\u011bl<\/a><\/noindex> o existenci pythonovsk\u00e9ho asycio a dal\u0161\u00edch trivi\u00e1ln\u00edch implementac\u00edch. Kdyby v\u011bd\u011bl o asycio, mohl by svou utilitu realizovat pouze v 18 \u0159\u00e1dc\u00edch v Pythonu:<\/p>\n
import asyncio\nimport random\n\nasync def handler(_reader, writer):\ntry:\nwhile True:\nawait asyncio.sleep(10)\nwriter.write(b'%xrn' % random.randint(0, 2**32))\nawait writer.drain()\nexcept ConnectionResetError:\npass\n\nasync def main():\nserver = await asyncio.start_server(handler, '0.0.0.0', 2222)\nasync with server:\nawait server.serve_forever()\n\nasyncio.run(main())<\/code><\/pre>\n
\nAsyncio je perfektn\u00ed pro psan\u00ed tarpits. Nap\u0159\u00edklad takov\u00e1 past by mohla na dlouhou dobu zmrazit Firefox, Chrome nebo jin\u00e9ho klienta, kter\u00fd se pokou\u0161\u00ed p\u0159ipojit k va\u0161emu HTTP serveru:<\/p>\n
import asyncio\nimport random\n\nasync def handler(_reader, writer):\nwriter.write(b'HTTP\\\/1.1 200 OKrn')\ntry:\nwhile True:\nawait asyncio.sleep(5)\nheader = random.randint(0, 2**32)\nvalue = random.randint(0, 2**32)\nwriter.write(b'X-%x: %xrn' % (header, value))\nawait writer.drain()\nexcept ConnectionResetError:\npass\n\nasync def main():\nserver = await asyncio.start_server(handler, '0.0.0.0', 8080)\nasync with server:\nawait server.serve_forever()\n\nasyncio.run(main())<\/code><\/pre>\n
\nTarpit je skv\u011bl\u00fd n\u00e1stroj k potrest\u00e1n\u00ed internetov\u00fdch barbr\u016f. Samoz\u0159ejm\u011b existuje ur\u010dit\u00e9 riziko, \u017ee naopak p\u0159it\u00e1hnete jejich pozornost neobvykl\u00fdm chov\u00e1n\u00edm konkr\u00e9tn\u00edho serveru. N\u011bkdo m\u016f\u017ee pomyslet na pomstu<\/a><\/noindex> a c\u00edlen\u00fd DDoS \u00fatok na va\u0161i IP adresu. A\u010dkoliv, zat\u00edm se takov\u00e9 p\u0159\u00edpady nevyskytly a tarpity funguj\u00ed skv\u011ble.<\/p>\n
Kategorie:
\nPython, Bezpe\u010dnost informac\u00ed, Software, Syst\u00e9mov\u00e1 administrace<\/p>\n
\u0160t\u00edtky:
\nSSH, Endlessh, tarpit, past, asyncio
\nL\u00e1kadlo (tarpit) pro p\u0159\u00edchoz\u00ed SSH p\u0159ipojen\u00ed<\/p>\n
Nen\u00ed tajemstv\u00edm, \u017ee internet je velmi nep\u0159\u00e1telsk\u00e9 prost\u0159ed\u00ed. Jakmile spust\u00edte server, okam\u017eit\u011b se vystavujete intenzivn\u00edm \u00fatok\u016fm a mno\u017estv\u00ed skenov\u00e1n\u00ed. Na p\u0159\u00edkladu honeypota od bezpe\u010dnostn\u00edch expert\u016f<\/a><\/noindex> m\u016f\u017eeme posoudit rozsah tohoto odpadkov\u00e9ho provozu. Ve skute\u010dnosti m\u016f\u017ee na pr\u016fm\u011brn\u00e9m serveru b\u00fdt 99 % provozu \u0161kodliv\u00e9.<\/p>\n
Tarpit je portov\u00e1 past, kter\u00e1 se pou\u017e\u00edv\u00e1 ke zpomalen\u00ed p\u0159\u00edchoz\u00edch spojen\u00ed. Pokud se t\u0159et\u00ed syst\u00e9m p\u0159ipoj\u00ed k tomuto portu, rychle uzav\u0159\u00edt spojen\u00ed nebude mo\u017en\u00e9. Bude muset vy\u010derpat sv\u00e9 syst\u00e9mov\u00e9 zdroje a \u010dekat, a\u017e spojen\u00ed nebude p\u0159eru\u0161eno kv\u016fli timeoutu, nebo ho manu\u00e1ln\u011b p\u0159eru\u0161it.<\/p>\n
Nej\u010dast\u011bji se tarpity pou\u017e\u00edvaj\u00ed na ochranu. Tato technika byla poprv\u00e9 vyvinuta k ochran\u011b proti po\u010d\u00edta\u010dov\u00fdm \u010derv\u016fm. A nyn\u00ed ji lze vyu\u017e\u00edt k znep\u0159\u00edjemn\u011bn\u00ed \u017eivota spammer\u016fm a v\u00fdzkumn\u00edk\u016fm, kte\u0159\u00ed se v\u011bnuj\u00ed rozs\u00e1hl\u00e9mu skenov\u00e1n\u00ed v\u0161ech IP adres za sebou (p\u0159\u00edklady na Habr: Rakousko<\/a><\/noindex>, Ukrajina<\/a><\/noindex>).<\/p>\n
Jednomu z administr\u00e1tor\u016f, jm\u00e9nem Chris Wellons, z\u0159ejm\u011b p\u0159estalo bavit sledovat tuto nepo\u0159\u00e1dek \u2014 a napsal mal\u00fd program Endlessh<\/a><\/noindex>, tarpity pro SSH, kter\u00fd zpomaluje p\u0159\u00edchoz\u00ed spojen\u00ed. Program otev\u0159e port (ve v\u00fdchoz\u00edm nastaven\u00ed je pro testov\u00e1n\u00ed uveden port 2222) a tv\u00e1\u0159\u00ed se jako SSH server, ale ve skute\u010dnosti vytv\u00e1\u0159\u00ed nekone\u010dn\u00e9 spojen\u00ed s p\u0159\u00edchoz\u00edm klientem, dokud se nevzd\u00e1. To m\u016f\u017ee trvat n\u011bkolik dn\u00ed nebo d\u00e9le, dokud klient nevypadne.<\/p>\n
Instalace utility:<\/p>\n
$ make\n$ .\/endlessh &\n$ ssh -p2222 localhost<\/code><\/pre>\n
\nSpr\u00e1vn\u011b implementovan\u00fd tarpity odebere \u00fato\u010dn\u00edkovi v\u00edce zdroj\u016f ne\u017e v\u00e1m. Ale jde nejen o zdroje. Autor p\u00ed\u0161e<\/a><\/noindex>, \u017ee program vyvol\u00e1v\u00e1 z\u00e1vislost. Pr\u00e1v\u011b te\u010f m\u00e1 v jeho pasti 27 klient\u016f, n\u011bkte\u0159\u00ed jsou p\u0159ipojeni po t\u00fddny. V \u0161pi\u010dce aktivity bylo v pasti 1378 klient\u016f po dobu 20 hodin!<\/p>\n
V provozn\u00edm re\u017eimu je t\u0159eba server Endlessh um\u00edstit na b\u011b\u017en\u00fd port 22, na kter\u00fd masivn\u011b \u00fato\u010d\u00ed zlod\u011bji. Standardn\u00ed bezpe\u010dnostn\u00ed doporu\u010den\u00ed v\u017edy rad\u00ed p\u0159esunout SSH na jin\u00fd port, co\u017e okam\u017eit\u011b v\u00fdrazn\u011b zkracuje velikost log\u016f.<\/p>\n
Chris Wellons \u0159\u00edk\u00e1, \u017ee jeho program vyu\u017e\u00edv\u00e1 jeden odstavec ze specifikace RFC 4253<\/a><\/noindex> o protokolu SSH. Ihned po nav\u00e1z\u00e1n\u00ed spojen\u00ed TCP, ale p\u0159ed pou\u017eit\u00edm kryptografie, by se ob\u011b strany m\u011bly poslat identifika\u010dn\u00ed \u0159et\u011bzec. A tam je tak\u00e9 pozn\u00e1mka: \u201eServer m\u016f\u017ee poslat dal\u0161\u00ed \u0159\u00e1dky dat p\u0159ed odesl\u00e1n\u00edm \u0159\u00e1dku s verz\u00ed\u201c<\/i>. A \u017e\u00e1dn\u00e9 omezen\u00ed<\/b> na objem t\u011bchto dat, pouze ka\u017ed\u00fd \u0159\u00e1dek by m\u011bl za\u010d\u00ednat s SSH-<\/code>.<\/p>\n
T\u00edmto se zab\u00fdv\u00e1 program Endlessh: vytv\u00e1\u0159\u00ed odes\u00edl\u00e1 nekone\u010dn\u00fd<\/i> tok n\u00e1hodn\u011b generovan\u00fdch dat<\/b>, kter\u00e9 odpov\u00eddaj\u00ed RFC 4253, to znamen\u00e1, \u017ee jsou odes\u00edl\u00e1ny p\u0159ed identifikac\u00ed, a ka\u017ed\u00fd \u0159\u00e1dek za\u010d\u00edn\u00e1 s SSH-<\/code> a nep\u0159esahuje 255 znak\u016f v\u010detn\u011b koncov\u00e9ho znaku \u0159\u00e1dku. Celkov\u011b je to v souladu se standardem.<\/p>\n
Ve defaultn\u00edm nastaven\u00ed program \u010dek\u00e1 10 sekund mezi odes\u00edl\u00e1n\u00edm paket\u016f. To zabra\u0148uje odpojen\u00ed kv\u016fli timeoutu, tak\u017ee klient z\u016fstane uv\u011bzn\u011bn nav\u017edy.<\/p>\n
Proto\u017ee odes\u00edl\u00e1n\u00ed dat prob\u00edh\u00e1 p\u0159ed aplikac\u00ed \u0161ifrov\u00e1n\u00ed, je program v\u00fdjime\u010dn\u011b jednoduch\u00fd. Nen\u00ed t\u0159eba implementovat \u017e\u00e1dn\u00e9 \u0161ifry a podporu mnoha protokol\u016f.<\/p>\n
Autor se sna\u017eil, aby utilita spot\u0159ebov\u00e1vala minimum zdroj\u016f a fungovala zcela nen\u00e1padn\u011b na stroji. Na rozd\u00edl od modern\u00edch antivir\u016f a jin\u00fdch \u201abezpe\u010dnostn\u00edch syst\u00e9m\u016f\u2018 by nem\u011bla zpomalovat po\u010d\u00edta\u010d. Poda\u0159ilo se minimalizovat jak provoz, tak i spot\u0159ebu pam\u011bti d\u00edky trochu chyt\u0159ej\u0161\u00ed programov\u00e9 implementaci. Kdyby prost\u011b spou\u0161t\u011bl samostatn\u00fd proces na nov\u00e9 spojen\u00ed, potenci\u00e1ln\u00ed \u00fato\u010dn\u00edci by mohli prov\u00e9st DDoS \u00fatok otev\u0159en\u00edm mnoha spojen\u00ed k vy\u010derp\u00e1n\u00ed zdroj\u016f na stroji. Jeden tok na spojen\u00ed \u2014 tak\u00e9 nen\u00ed nejlep\u0161\u00ed varianta, proto\u017ee j\u00e1dro by pl\u00fdtvalo zdroji na spr\u00e1vu tok\u016f.<\/p>\n
Proto Chris Vellons zvolil pro Endlessh nejleh\u010d\u00ed variantu: jednovl\u00e1knov\u00fd server poll(2)<\/code>, kde klienti v pasti prakticky nepou\u017e\u00edvaj\u00ed \u017e\u00e1dn\u00e9 dal\u0161\u00ed zdroje, krom\u011b objektu socketu v j\u00e1d\u0159e a je\u0161t\u011b 78 byt\u016f pro sledov\u00e1n\u00ed v Endlessh. Aby nemuseli alokovat vyrovn\u00e1vac\u00ed pam\u011bti pro p\u0159\u00edjem a odes\u00edl\u00e1n\u00ed pro ka\u017ed\u00e9ho klienta, Endlessh otv\u00edr\u00e1 socket p\u0159\u00edm\u00e9ho p\u0159\u00edstupu a p\u0159\u00edmo p\u0159en\u00e1\u0161\u00ed TCP pakety, t\u00e9m\u011b\u0159 ignoruje cel\u00fd TCP\/IP stack opera\u010dn\u00edho syst\u00e9mu. P\u0159ich\u00e1zej\u00edc\u00ed buffer v\u016fbec nen\u00ed pot\u0159eba, proto\u017ee p\u0159\u00edchoz\u00ed data n\u00e1s nezaj\u00edmaj\u00ed.<\/p>\n
Autor \u0159\u00edk\u00e1, \u017ee v dob\u011b vytv\u00e1\u0159en\u00ed sv\u00e9 aplikace nev\u011bd\u011bl<\/a><\/noindex> o existenci pythonovsk\u00e9ho asycio a dal\u0161\u00edch trivi\u00e1ln\u00edch implementac\u00edch. Kdyby v\u011bd\u011bl o asycio, mohl by svou utilitu realizovat pouze v 18 \u0159\u00e1dc\u00edch v Pythonu:<\/p>\n
import asyncio\nimport random\n\nasync def handler(_reader, writer):\n    try:\n        while True:\n            await asyncio.sleep(10)\n            writer.write(b'%xrn' % random.randint(0, 2**32))\n            await writer.drain()\n    except ConnectionResetError:\n        pass\n\nasync def main():\n    server = await asyncio.start_server(handler, '0.0.0.0', 2222)\n    async with server:\n        await server.serve_forever()\n\nasyncio.run(main())<\/code><\/pre>\n
\nAsyncio je perfektn\u00ed pro psan\u00ed tarpits. Nap\u0159\u00edklad takov\u00e1 past by mohla na dlouhou dobu zmrazit Firefox, Chrome nebo jin\u00e9ho klienta, kter\u00fd se pokou\u0161\u00ed p\u0159ipojit k va\u0161emu HTTP serveru:<\/p>\n
import asyncio\nimport random\n\nasync def handler(_reader, writer):\n    writer.write(b'HTTP\\\/1.1 200 OKrn')\n    try:\n        while True:\n            await asyncio.sleep(5)\n            header = random.randint(0, 2**32)\n            value = random.randint(0, 2**32)\n            writer.write(b'X-%x: %xrn' % (header, value))\n            await writer.drain()\n    except ConnectionResetError:\n        pass\n\nasync def main():\n    server = await asyncio.start_server(handler, '0.0.0.0', 8080)\n    async with server:\n        await server.serve_forever()\n\nasyncio.run(main())<\/code><\/pre>\n
\nTarpit je skv\u011bl\u00fd n\u00e1stroj k potrest\u00e1n\u00ed internetov\u00fdch barbr\u016f. Samoz\u0159ejm\u011b existuje ur\u010dit\u00e9 riziko, \u017ee naopak p\u0159it\u00e1hnete jejich pozornost neobvykl\u00fdm chov\u00e1n\u00edm konkr\u00e9tn\u00edho serveru. N\u011bkdo m\u016f\u017ee pomyslet na pomstu<\/a><\/noindex> a c\u00edlen\u00fd DDoS \u00fatok na va\u0161i IP adresu. A\u010dkoliv, zat\u00edm se takov\u00e9 p\u0159\u00edpady nevyskytly a tarpity funguj\u00ed skv\u011ble.<\/p>\n
\n\"L\u00e1kadlo<\/a><\/noindex>
\n
Zdroj: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u041d\u0435 \u0441\u0435\u043a\u0440\u0435\u0442, \u0447\u0442\u043e \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u2014 \u043e\u0447\u0435\u043d\u044c \u0432\u0440\u0430\u0436\u0434\u0435\u0431\u043d\u0430\u044f \u0441\u0440\u0435\u0434\u0430. \u041a\u0430\u043a \u0442\u043e\u043b\u044c\u043a\u043e \u0432\u044b \u043f\u043e\u0434\u043d\u0438\u043c\u0430\u0435\u0442\u0435 \u0441\u0435\u0440\u0432\u0435\u0440, \u043e\u043d \u043c\u0433\u043d\u043e\u0432\u0435\u043d\u043d\u043e \u043f\u043e\u0434\u0432\u0435\u0440\u0433\u0430\u0435\u0442\u0441\u044f \u043c\u0430\u0441\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0430\u0442\u0430\u043a\u0430\u043c \u0438 \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u043c \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f\u043c. \u041d\u0430 \u043f\u0440\u0438\u043c\u0435\u0440\u0435 \u0445\u0430\u043d\u0438\u043f\u043e\u0442\u0430 \u043e\u0442 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0438\u043a\u043e\u0432 \u043c\u043e\u0436\u043d\u043e \u043e\u0446\u0435\u043d\u0438\u0442\u044c \u043c\u0430\u0441\u0448\u0442\u0430\u0431 \u044d\u0442\u043e\u0433\u043e \u043c\u0443\u0441\u043e\u0440\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430. \u0424\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438, \u043d\u0430 \u0441\u0440\u0435\u0434\u043d\u0435\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 99% \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c. Tarpit \u2014 \u044d\u0442\u043e \u043f\u043e\u0440\u0442-\u043b\u043e\u0432\u0443\u0448\u043a\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u0437\u0430\u043c\u0435\u0434\u043b\u0435\u043d\u0438\u044f \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0445 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439. \u0415\u0441\u043b\u0438 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u044f\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-30312","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Past (tarpit) pro p\u0159\u00edchoz\u00ed SSH p\u0159ipojen\u00ed | ProHoster","description":"Nen\u00ed \u017e\u00e1dn\u00fdm tajemstv\u00edm, \u017ee internet je velmi nep\u0159\u00e1telsk\u00e9 prost\u0159ed\u00ed. Jakmile spust\u00edte server, okam\u017eit\u011b je vystaven masivn\u00edm \u00fatok\u016fm a mnoha skenov\u00e1n\u00edm.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/lovushka-tarpit-dlya-vhodyashhih-ssh-soedinenij","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041b\u043e\u0432\u0443\u0448\u043a\u0430 (\u0442\u0430\u0440\u043f\u0438\u0442) \u0434\u043b\u044f \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0445 SSH-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439 | ProHoster","og:description":"\u041d\u0435 \u0441\u0435\u043a\u0440\u0435\u0442, \u0447\u0442\u043e \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u2014 \u043e\u0447\u0435\u043d\u044c \u0432\u0440\u0430\u0436\u0434\u0435\u0431\u043d\u0430\u044f \u0441\u0440\u0435\u0434\u0430. \u041a\u0430\u043a \u0442\u043e\u043b\u044c\u043a\u043e \u0432\u044b \u043f\u043e\u0434\u043d\u0438\u043c\u0430\u0435\u0442\u0435 \u0441\u0435\u0440\u0432\u0435\u0440, \u043e\u043d \u043c\u0433\u043d\u043e\u0432\u0435\u043d\u043d\u043e \u043f\u043e\u0434\u0432\u0435\u0440\u0433\u0430\u0435\u0442\u0441\u044f \u043c\u0430\u0441\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0430\u0442\u0430\u043a\u0430\u043c \u0438 \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u043c \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f\u043c.","og:url":"https:\/\/prohoster.info\/cs\/blog\/lovushka-tarpit-dlya-vhodyashhih-ssh-soedinenij","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:34:49+00:00","article:modified_time":"2019-10-31T18:34:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"30312","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 00:38:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:37:27","updated":"2026-01-21 00:38:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/30312","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=30312"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/30312\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=30312"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=30312"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=30312"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}