It's no secret that the internet is a very hostile environment. As soon as you bring up a server, it is immediately subjected to massive attacks and multiple scans. For example, can illustrate the scale of this junk traffic. In fact, on an average server, 99% of the traffic can be malicious.
A tarpit is a port trap used to slow down incoming connections. If an outside system connects to this port, it will not be able to quickly close the connection. It will have to spend its system resources waiting for the connection to timeout or manually terminate it.
Most often, tarpits are used for protection. The technique was first developed to defend against computer worms. Now it can be used to make life difficult for spammers and researchers who engage in extensive scanning of all IP addresses in succession (examples on Habr: , ).
One system administrator named Chris Wellons apparently got tired of watching this chaos — and he wrote a small program , a tarpit for SSH that slows down incoming connections. The program opens a port (the default testing port is 2222) and pretends to be an SSH server, while in fact establishing an endless connection with the incoming client until it gives up. This can go on for several days or more until the client disconnects.
Installing the utility:
$ make
$ ./endlessh &
$ ssh -p2222 localhostA properly implemented tarpit will take more resources from the attacker than from you. But it's not just about resources. The author mentions that the program is addictive. Right now, there are 27 clients trapped in it, some of whom have been connected for weeks. At peak activity, there were 1378 clients trapped for 20 hours!
In operational mode, the Endlessh server should be placed on the standard port 22, where hoodlums frequently attempt to connect. Standard security recommendations always suggest moving SSH to another port, which immediately reduces the log size significantly.
Chris Wellons says his program exploits one paragraph from the specification on the SSH protocol. Immediately after establishing a TCP connection, but before cryptography is applied, both sides must send an identification string. And there is also a note: "The server CAN send other lines of data before sending the version line". And no limit on the amount of this data, each line just needs to start with SSH-.
This is exactly what the Endlessh program does: it sends an endless stream of randomly generated data, which complies with RFC 4253, meaning it sends data before identification, and each line starts with SSH- and does not exceed 255 characters, including the newline character. In summary, everything follows the standard.
By default, the program waits 10 seconds between sending packets. This prevents disconnection due to a timeout, so the client will remain in the trap indefinitely.
Since data is sent before applying cryptography, the program is extremely simple. There is no need to implement any encryptions and support multiple protocols.
The author has aimed to ensure the utility consumes minimal resources and operates completely unnoticed on the machine. Unlike modern antivirus and other "security systems," it should not slow down the computer. He managed to minimize both traffic and memory consumption through a slightly more sophisticated software implementation. If he simply launched a separate process for each new connection, potential attackers could execute a DDoS attack by opening multiple connections to exhaust resources on the machine. One thread per connection is also not the best option, as the kernel would spend resources managing threads.
That’s why Chris Vellons chose the most lightweight option for Endlessh: a single-thread server poll(2), where trapped clients consume almost no extra resources, aside from the socket object in the kernel and 78 bytes for tracking in Endlessh. To avoid allocating receive and send buffers for each client, Endlessh opens a direct access socket and directly streams TCP packets, ignoring almost the entire TCP/IP stack of the operating system. An incoming buffer is not needed at all because incoming data is of no interest to us.
The author states that at the time of creating his program of the existence of Python's asyncio and other coroutines. Had he known about asyncio, he could have implemented his utility in just 18 lines of Python:
import asyncio
import random
async def handler(_reader, writer):
try:
while True:
await asyncio.sleep(10)
writer.write(b'%xrn' % random.randint(0, 2**32))
await writer.drain()
except ConnectionResetError:
pass
async def main():
server = await asyncio.start_server(handler, '0.0.0.0', 2222)
async with server:
await server.serve_forever()
asyncio.run(main())Asyncio is perfect for writing tar pits. For example, such a trap can hang Firefox, Chrome, or any other client attempting to connect to your HTTP server for hours.
import asyncio
import random
async def handler(_reader, writer):
writer.write(b'HTTP\/1.1 200 OKrn')
try:
while True:
await asyncio.sleep(5)
header = random.randint(0, 2**32)
value = random.randint(0, 2**32)
writer.write(b'X-%x: %xrn' % (header, value))
await writer.drain()
except ConnectionResetError:
pass
async def main():
server = await asyncio.start_server(handler, '0.0.0.0', 8080)
async with server:
await server.serve_forever()
asyncio.run(main())A tar pit is an excellent tool for punishing internet bullies. However, there is some risk of drawing their attention to the unusual behavior of a specific server. Someone and target a DDoS attack against your IP. However, there have been no such cases so far, and tar pits work great.
Hubs:
Python, Information Security, Software, System Administration
Tags:
SSH, Endlessh, tarpit, tar pit, trap, asyncio
A trap (tar pit) for incoming SSH connections.
It's no secret that the internet is a very hostile environment. As soon as you bring up a server, it is immediately subjected to massive attacks and multiple scans. For example, can illustrate the scale of this junk traffic. In fact, on an average server, 99% of the traffic can be malicious.
A tarpit is a port trap used to slow down incoming connections. If an outside system connects to this port, it will not be able to quickly close the connection. It will have to spend its system resources waiting for the connection to timeout or manually terminate it.
Most often, tarpits are used for protection. The technique was first developed to defend against computer worms. Now it can be used to make life difficult for spammers and researchers who engage in extensive scanning of all IP addresses in succession (examples on Habr: , ).
One system administrator named Chris Wellons apparently got tired of watching this chaos — and he wrote a small program , a tarpit for SSH that slows down incoming connections. The program opens a port (the default testing port is 2222) and pretends to be an SSH server, while in fact establishing an endless connection with the incoming client until it gives up. This can go on for several days or more until the client disconnects.
Installing the utility:
$ make
$ ./endlessh &
$ ssh -p2222 localhostA properly implemented tarpit will take more resources from the attacker than from you. But it's not just about resources. The author mentions that the program is addictive. Right now, there are 27 clients trapped in it, some of whom have been connected for weeks. At peak activity, there were 1378 clients trapped for 20 hours!
In operational mode, the Endlessh server should be placed on the standard port 22, where hoodlums frequently attempt to connect. Standard security recommendations always suggest moving SSH to another port, which immediately reduces the log size significantly.
Chris Wellons says his program exploits one paragraph from the specification on the SSH protocol. Immediately after establishing a TCP connection, but before cryptography is applied, both sides must send an identification string. And there is also a note: "The server CAN send other lines of data before sending the version line". And no limit on the amount of this data, each line just needs to start with SSH-.
This is exactly what the Endlessh program does: it sends an endless stream of randomly generated data, which complies with RFC 4253, meaning it sends data before identification, and each line starts with SSH- and does not exceed 255 characters, including the newline character. In summary, everything follows the standard.
By default, the program waits 10 seconds between sending packets. This prevents disconnection due to a timeout, so the client will remain in the trap indefinitely.
Since data is sent before applying cryptography, the program is extremely simple. There is no need to implement any encryptions and support multiple protocols.
The author has aimed to ensure the utility consumes minimal resources and operates completely unnoticed on the machine. Unlike modern antivirus and other "security systems," it should not slow down the computer. He managed to minimize both traffic and memory consumption through a slightly more sophisticated software implementation. If he simply launched a separate process for each new connection, potential attackers could execute a DDoS attack by opening multiple connections to exhaust resources on the machine. One thread per connection is also not the best option, as the kernel would spend resources managing threads.
That’s why Chris Vellons chose the most lightweight option for Endlessh: a single-thread server poll(2), where trapped clients consume almost no extra resources, aside from the socket object in the kernel and 78 bytes for tracking in Endlessh. To avoid allocating receive and send buffers for each client, Endlessh opens a direct access socket and directly streams TCP packets, ignoring almost the entire TCP/IP stack of the operating system. An incoming buffer is not needed at all because incoming data is of no interest to us.
The author states that at the time of creating his program of the existence of Python's asyncio and other coroutines. Had he known about asyncio, he could have implemented his utility in just 18 lines of Python:
import asyncio
import random
async def handler(_reader, writer):
try:
while True:
await asyncio.sleep(10)
writer.write(b'%xrn' % random.randint(0, 2**32))
await writer.drain()
except ConnectionResetError:
pass
async def main():
server = await asyncio.start_server(handler, '0.0.0.0', 2222)
async with server:
await server.serve_forever()
asyncio.run(main())Asyncio is perfect for writing tar pits. For example, such a trap can hang Firefox, Chrome, or any other client attempting to connect to your HTTP server for hours.
import asyncio
import random
async def handler(_reader, writer):
writer.write(b'HTTP\/1.1 200 OKrn')
try:
while True:
await asyncio.sleep(5)
header = random.randint(0, 2**32)
value = random.randint(0, 2**32)
writer.write(b'X-%x: %xrn' % (header, value))
await writer.drain()
except ConnectionResetError:
pass
async def main():
server = await asyncio.start_server(handler, '0.0.0.0', 8080)
async with server:
await server.serve_forever()
asyncio.run(main())A tar pit is an excellent tool for punishing internet bullies. However, there is some risk of drawing their attention to the unusual behavior of a specific server. Someone and target a DDoS attack against your IP. However, there have been no such cases so far, and tar pits work great.
Source: habr.com
