{"id":30312,"date":"2019-10-31T21:34:49","date_gmt":"2019-10-31T18:34:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/lovushka-tarpit-dlya-vhodyashhih-ssh-soedinenij\/"},"modified":"2019-10-31T21:34:49","modified_gmt":"2019-10-31T18:34:49","slug":"lovushka-tarpit-dlya-vhodyashhih-ssh-soedinenij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/lovushka-tarpit-dlya-vhodyashhih-ssh-soedinenij","title":{"rendered":"A trap (tar pit) for incoming SSH connections.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

It's no secret that the internet is a very hostile environment. As soon as you bring up a server, it is immediately subjected to massive attacks and multiple scans. For example, a honeypot from security experts<\/a><\/noindex> can illustrate the scale of this junk traffic. In fact, on an average server, 99% of the traffic can be malicious.<\/p>\n

A tarpit is a port trap used to slow down incoming connections. If an outside system connects to this port, it will not be able to quickly close the connection. It will have to spend its system resources waiting for the connection to timeout or manually terminate it.<\/p>\n

Most often, tarpits are used for protection. The technique was first developed to defend against computer worms. Now it can be used to make life difficult for spammers and researchers who engage in extensive scanning of all IP addresses in succession (examples on Habr: Austria<\/a><\/noindex>, Ukraine<\/a><\/noindex>).
\n<\/a><\/noindex>
\nOne system administrator named Chris Wellons apparently got tired of watching this chaos \u2014 and he wrote a small program Endlessh<\/a><\/noindex>, a tarpit for SSH that slows down incoming connections. The program opens a port (the default testing port is 2222) and pretends to be an SSH server, while in fact establishing an endless connection with the incoming client until it gives up. This can go on for several days or more until the client disconnects.<\/p>\n

Installing the utility:<\/p>\n

$ make\n$ .\/endlessh &\n$ ssh -p2222 localhost<\/code><\/pre>\n
\nA properly implemented tarpit will take more resources from the attacker than from you. But it's not just about resources. The author writes<\/a><\/noindex>mentions that the program is addictive. Right now, there are 27 clients trapped in it, some of whom have been connected for weeks. At peak activity, there were 1378 clients trapped for 20 hours!<\/p>\n
In operational mode, the Endlessh server should be placed on the standard port 22, where hoodlums frequently attempt to connect. Standard security recommendations always suggest moving SSH to another port, which immediately reduces the log size significantly.<\/p>\n
Chris Wellons says his program exploits one paragraph from the specification RFC 4253<\/a><\/noindex> on the SSH protocol. Immediately after establishing a TCP connection, but before cryptography is applied, both sides must send an identification string. And there is also a note: \"The server CAN send other lines of data before sending the version line\"<\/i>. And no limit<\/b> on the amount of this data, each line just needs to start with SSH-<\/code>.<\/p>\n
This is exactly what the Endlessh program does: it sends an endless<\/i> stream of randomly generated data<\/b>, which complies with RFC 4253, meaning it sends data before identification, and each line starts with SSH-<\/code> and does not exceed 255 characters, including the newline character. In summary, everything follows the standard.<\/p>\n
By default, the program waits 10 seconds between sending packets. This prevents disconnection due to a timeout, so the client will remain in the trap indefinitely.<\/p>\n
Since data is sent before applying cryptography, the program is extremely simple. There is no need to implement any encryptions and support multiple protocols.<\/p>\n
The author has aimed to ensure the utility consumes minimal resources and operates completely unnoticed on the machine. Unlike modern antivirus and other \"security systems,\" it should not slow down the computer. He managed to minimize both traffic and memory consumption through a slightly more sophisticated software implementation. If he simply launched a separate process for each new connection, potential attackers could execute a DDoS attack by opening multiple connections to exhaust resources on the machine. One thread per connection is also not the best option, as the kernel would spend resources managing threads.<\/p>\n
That\u2019s why Chris Vellons chose the most lightweight option for Endlessh: a single-thread server poll(2)<\/code>, where trapped clients consume almost no extra resources, aside from the socket object in the kernel and 78 bytes for tracking in Endlessh. To avoid allocating receive and send buffers for each client, Endlessh opens a direct access socket and directly streams TCP packets, ignoring almost the entire TCP\/IP stack of the operating system. An incoming buffer is not needed at all because incoming data is of no interest to us.<\/p>\n
The author states that at the time of creating his program he was unaware<\/a><\/noindex> of the existence of Python's asyncio and other coroutines. Had he known about asyncio, he could have implemented his utility in just 18 lines of Python:<\/p>\n
import asyncio\nimport random\n\nasync def handler(_reader, writer):\ntry:\nwhile True:\nawait asyncio.sleep(10)\nwriter.write(b'%xrn' % random.randint(0, 2**32))\nawait writer.drain()\nexcept ConnectionResetError:\npass\n\nasync def main():\nserver = await asyncio.start_server(handler, '0.0.0.0', 2222)\nasync with server:\nawait server.serve_forever()\n\nasyncio.run(main())<\/code><\/pre>\n
\nAsyncio is perfect for writing tar pits. For example, such a trap can hang Firefox, Chrome, or any other client attempting to connect to your HTTP server for hours.<\/p>\n
import asyncio\nimport random\n\nasync def handler(_reader, writer):\nwriter.write(b'HTTP\\\/1.1 200 OKrn')\ntry:\nwhile True:\nawait asyncio.sleep(5)\nheader = random.randint(0, 2**32)\nvalue = random.randint(0, 2**32)\nwriter.write(b'X-%x: %xrn' % (header, value))\nawait writer.drain()\nexcept ConnectionResetError:\npass\n\nasync def main():\nserver = await asyncio.start_server(handler, '0.0.0.0', 8080)\nasync with server:\nawait server.serve_forever()\n\nasyncio.run(main())<\/code><\/pre>\n
\nA tar pit is an excellent tool for punishing internet bullies. However, there is some risk of drawing their attention to the unusual behavior of a specific server. Someone may think of retaliation<\/a><\/noindex> and target a DDoS attack against your IP. However, there have been no such cases so far, and tar pits work great.<\/p>\n
Hubs:
\nPython, Information Security, Software, System Administration<\/p>\n
Tags:
\nSSH, Endlessh, tarpit, tar pit, trap, asyncio
\nA trap (tar pit) for incoming SSH connections.<\/p>\n
It's no secret that the internet is a very hostile environment. As soon as you bring up a server, it is immediately subjected to massive attacks and multiple scans. For example, a honeypot from security experts<\/a><\/noindex> can illustrate the scale of this junk traffic. In fact, on an average server, 99% of the traffic can be malicious.<\/p>\n
A tarpit is a port trap used to slow down incoming connections. If an outside system connects to this port, it will not be able to quickly close the connection. It will have to spend its system resources waiting for the connection to timeout or manually terminate it.<\/p>\n
Most often, tarpits are used for protection. The technique was first developed to defend against computer worms. Now it can be used to make life difficult for spammers and researchers who engage in extensive scanning of all IP addresses in succession (examples on Habr: Austria<\/a><\/noindex>, Ukraine<\/a><\/noindex>).<\/p>\n
One system administrator named Chris Wellons apparently got tired of watching this chaos \u2014 and he wrote a small program Endlessh<\/a><\/noindex>, a tarpit for SSH that slows down incoming connections. The program opens a port (the default testing port is 2222) and pretends to be an SSH server, while in fact establishing an endless connection with the incoming client until it gives up. This can go on for several days or more until the client disconnects.<\/p>\n
Installing the utility:<\/p>\n
$ make\n$ .\/endlessh &\n$ ssh -p2222 localhost<\/code><\/pre>\n
\nA properly implemented tarpit will take more resources from the attacker than from you. But it's not just about resources. The author writes<\/a><\/noindex>mentions that the program is addictive. Right now, there are 27 clients trapped in it, some of whom have been connected for weeks. At peak activity, there were 1378 clients trapped for 20 hours!<\/p>\n
In operational mode, the Endlessh server should be placed on the standard port 22, where hoodlums frequently attempt to connect. Standard security recommendations always suggest moving SSH to another port, which immediately reduces the log size significantly.<\/p>\n
Chris Wellons says his program exploits one paragraph from the specification RFC 4253<\/a><\/noindex> on the SSH protocol. Immediately after establishing a TCP connection, but before cryptography is applied, both sides must send an identification string. And there is also a note: \"The server CAN send other lines of data before sending the version line\"<\/i>. And no limit<\/b> on the amount of this data, each line just needs to start with SSH-<\/code>.<\/p>\n
This is exactly what the Endlessh program does: it sends an endless<\/i> stream of randomly generated data<\/b>, which complies with RFC 4253, meaning it sends data before identification, and each line starts with SSH-<\/code> and does not exceed 255 characters, including the newline character. In summary, everything follows the standard.<\/p>\n
By default, the program waits 10 seconds between sending packets. This prevents disconnection due to a timeout, so the client will remain in the trap indefinitely.<\/p>\n
Since data is sent before applying cryptography, the program is extremely simple. There is no need to implement any encryptions and support multiple protocols.<\/p>\n
The author has aimed to ensure the utility consumes minimal resources and operates completely unnoticed on the machine. Unlike modern antivirus and other \"security systems,\" it should not slow down the computer. He managed to minimize both traffic and memory consumption through a slightly more sophisticated software implementation. If he simply launched a separate process for each new connection, potential attackers could execute a DDoS attack by opening multiple connections to exhaust resources on the machine. One thread per connection is also not the best option, as the kernel would spend resources managing threads.<\/p>\n
That\u2019s why Chris Vellons chose the most lightweight option for Endlessh: a single-thread server poll(2)<\/code>, where trapped clients consume almost no extra resources, aside from the socket object in the kernel and 78 bytes for tracking in Endlessh. To avoid allocating receive and send buffers for each client, Endlessh opens a direct access socket and directly streams TCP packets, ignoring almost the entire TCP\/IP stack of the operating system. An incoming buffer is not needed at all because incoming data is of no interest to us.<\/p>\n
The author states that at the time of creating his program he was unaware<\/a><\/noindex> of the existence of Python's asyncio and other coroutines. Had he known about asyncio, he could have implemented his utility in just 18 lines of Python:<\/p>\n
import asyncio\nimport random\n\nasync def handler(_reader, writer):\n    try:\n        while True:\n            await asyncio.sleep(10)\n            writer.write(b'%xrn' % random.randint(0, 2**32))\n            await writer.drain()\n    except ConnectionResetError:\n        pass\n\nasync def main():\n    server = await asyncio.start_server(handler, '0.0.0.0', 2222)\n    async with server:\n        await server.serve_forever()\n\nasyncio.run(main())<\/code><\/pre>\n
\nAsyncio is perfect for writing tar pits. For example, such a trap can hang Firefox, Chrome, or any other client attempting to connect to your HTTP server for hours.<\/p>\n
import asyncio\nimport random\n\nasync def handler(_reader, writer):\n    writer.write(b'HTTP\\\/1.1 200 OKrn')\n    try:\n        while True:\n            await asyncio.sleep(5)\n            header = random.randint(0, 2**32)\n            value = random.randint(0, 2**32)\n            writer.write(b'X-%x: %xrn' % (header, value))\n            await writer.drain()\n    except ConnectionResetError:\n        pass\n\nasync def main():\n    server = await asyncio.start_server(handler, '0.0.0.0', 8080)\n    async with server:\n        await server.serve_forever()\n\nasyncio.run(main())<\/code><\/pre>\n
\nA tar pit is an excellent tool for punishing internet bullies. However, there is some risk of drawing their attention to the unusual behavior of a specific server. Someone may think of retaliation<\/a><\/noindex> and target a DDoS attack against your IP. However, there have been no such cases so far, and tar pits work great.<\/p>\n
\n\"A<\/a><\/noindex>
\n
Source: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u041d\u0435 \u0441\u0435\u043a\u0440\u0435\u0442, \u0447\u0442\u043e \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u2014 \u043e\u0447\u0435\u043d\u044c \u0432\u0440\u0430\u0436\u0434\u0435\u0431\u043d\u0430\u044f \u0441\u0440\u0435\u0434\u0430. \u041a\u0430\u043a \u0442\u043e\u043b\u044c\u043a\u043e \u0432\u044b \u043f\u043e\u0434\u043d\u0438\u043c\u0430\u0435\u0442\u0435 \u0441\u0435\u0440\u0432\u0435\u0440, \u043e\u043d \u043c\u0433\u043d\u043e\u0432\u0435\u043d\u043d\u043e \u043f\u043e\u0434\u0432\u0435\u0440\u0433\u0430\u0435\u0442\u0441\u044f \u043c\u0430\u0441\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0430\u0442\u0430\u043a\u0430\u043c \u0438 \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u043c \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f\u043c. \u041d\u0430 \u043f\u0440\u0438\u043c\u0435\u0440\u0435 \u0445\u0430\u043d\u0438\u043f\u043e\u0442\u0430 \u043e\u0442 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0438\u043a\u043e\u0432 \u043c\u043e\u0436\u043d\u043e \u043e\u0446\u0435\u043d\u0438\u0442\u044c \u043c\u0430\u0441\u0448\u0442\u0430\u0431 \u044d\u0442\u043e\u0433\u043e \u043c\u0443\u0441\u043e\u0440\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430. \u0424\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438, \u043d\u0430 \u0441\u0440\u0435\u0434\u043d\u0435\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 99% \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c. Tarpit \u2014 \u044d\u0442\u043e \u043f\u043e\u0440\u0442-\u043b\u043e\u0432\u0443\u0448\u043a\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u0437\u0430\u043c\u0435\u0434\u043b\u0435\u043d\u0438\u044f \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0445 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439. \u0415\u0441\u043b\u0438 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u044f\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-30312","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47SSH Connection Trap (Tarpit) | ProHoster","description":"It is no secret that the internet is a very hostile environment. As soon as you set up a server, it is instantly subjected to massive attacks and multiple scans.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/lovushka-tarpit-dlya-vhodyashhih-ssh-soedinenij","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041b\u043e\u0432\u0443\u0448\u043a\u0430 (\u0442\u0430\u0440\u043f\u0438\u0442) \u0434\u043b\u044f \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0445 SSH-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439 | ProHoster","og:description":"\u041d\u0435 \u0441\u0435\u043a\u0440\u0435\u0442, \u0447\u0442\u043e \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u2014 \u043e\u0447\u0435\u043d\u044c \u0432\u0440\u0430\u0436\u0434\u0435\u0431\u043d\u0430\u044f \u0441\u0440\u0435\u0434\u0430. \u041a\u0430\u043a \u0442\u043e\u043b\u044c\u043a\u043e \u0432\u044b \u043f\u043e\u0434\u043d\u0438\u043c\u0430\u0435\u0442\u0435 \u0441\u0435\u0440\u0432\u0435\u0440, \u043e\u043d \u043c\u0433\u043d\u043e\u0432\u0435\u043d\u043d\u043e \u043f\u043e\u0434\u0432\u0435\u0440\u0433\u0430\u0435\u0442\u0441\u044f \u043c\u0430\u0441\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0430\u0442\u0430\u043a\u0430\u043c \u0438 \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u043c \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f\u043c.","og:url":"https:\/\/prohoster.info\/en\/blog\/lovushka-tarpit-dlya-vhodyashhih-ssh-soedinenij","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:34:49+00:00","article:modified_time":"2019-10-31T18:34:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"30312","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 00:38:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:37:27","updated":"2026-01-21 00:38:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/30312","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=30312"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/30312\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=30312"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=30312"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=30312"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}