{"id":30312,"date":"2019-10-31T21:34:49","date_gmt":"2019-10-31T18:34:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/lovushka-tarpit-dlya-vhodyashhih-ssh-soedinenij\/"},"modified":"2019-10-31T21:34:49","modified_gmt":"2019-10-31T18:34:49","slug":"lovushka-tarpit-dlya-vhodyashhih-ssh-soedinenij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/lovushka-tarpit-dlya-vhodyashhih-ssh-soedinenij","title":{"rendered":"Zamka (tar pit) za ulazne SSH veze","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Nije tajna da je internet vrlo neprijateljsko okru\u017eenje. \u010cim podignete server, odmah je izlo\u017een masovnim napadima i brojnim skeniranjima. Na primjeru <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/436076\/\">honeypota od sigurnosnih stru\u010dnjaka<\/a><\/noindex> mo\u017ee se procijeniti razmjer ovog sme\u0161nog prometa. U stvari, na prosje\u010dnom serveru 99% prometa mo\u017ee biti zlonamjernog.<\/p>\n<p>Tarpit je port-zamka koja se koristi za usporavanje ulaznih veza. Ako se vanjski sustav pove\u017ee na ovu to\u010dku, ne\u0107e mo\u0107i brzo zatvoriti vezu. Mora tro\u0161iti svoje sistemske resurse i \u010dekati dok veza ne prekine zbog isteka vremena, ili je ru\u010dno prekinuti.<\/p>\n<p>Tarpiti se naj\u010de\u0161\u0107e koriste za za\u0161titu. Tehnika je prvotno razvijena za za\u0161titu od ra\u010dunalnih crva. A sada se mo\u017ee koristiti da bi se ote\u017eao \u017eivot spammerima i istra\u017eiva\u010dima koji se bave opse\u017enim skeniranjem svih IP adresa (primjeri na Habr: <noindex><a rel=\"nofollow\" href=\"https:\/\/blog.haschek.at\/2019\/i-scanned-austria.html\">Austrija<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/444490\/\">Ukrajina<\/a><\/noindex>).<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nJednom od sysadmina po imenu Chris Wellons, o\u010digledno je dosadilo promatrati ovu nepravdu \u2013 i napisao je mali program <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/skeeto\/endlessh\">Endlessh<\/a><\/noindex>, tarpit za SSH, koji usporava ulazne veze. Program otvara port (po defaultu je postavljen port 2222 za testiranje) i pretvara se da je SSH server, dok zapravo uspostavlja beskona\u010dnu vezu s ulaznim klijentom, sve dok ne odustane. To mo\u017ee trajati nekoliko dana ili vi\u0161e, sve dok klijent ne ispadne.<\/p>\n<p>Instalacija alata:<\/p>\n<pre><code class=\"bash\">$ make\n$ .\/endlessh &amp;\n$ ssh -p2222 localhost<\/code><\/pre>\n<p>\nIspravno implementiran tarpit oduzima vi\u0161e resursa napada\u010du nego vama. No, stvar nije samo u resursima. Autor <noindex><a rel=\"nofollow\" href=\"https:\/\/nullprogram.com\/blog\/2019\/03\/22\/\">pi\u0161e<\/a><\/noindex>, napominje da program izaziva ovisnost. Upravo sada u njegovoj zamci je 27 klijenata, neki od njih su povezani ve\u0107 tjednima. Na vrhuncu aktivnosti u zamci je bilo 1378 klijenata tijekom 20 sati!<\/p>\n<p>U operativnom re\u017eimu, server Endlessh treba postaviti na uobi\u010dajeni port 22, gdje se masovno poku\u0161avaju spojiti huligani. Standardne sigurnosne preporuke uvijek savjetuju premje\u0161tanje SSH na drugi port, \u0161to odmah znatno smanjuje veli\u010dinu logova.<\/p>\n<p>Chris Wellons ka\u017ee da njegov program iskori\u0161tava jedan pasus iz specifikacije <noindex><a rel=\"nofollow\" href=\"https:\/\/tools.ietf.org\/html\/rfc4253#section-4.2\">RFC 4253<\/a><\/noindex> za protokol SSH. Odmah nakon uspostavljanja TCP veze, ali prije primjene kriptografije, obje strane trebaju poslati identifikacijsku oznaku. I tamo je zabilje\u0161ka: <i>\u201ePoslu\u017eitelj MO\u017dE poslati druge nizove podataka prije slanja niza s verzijom\u201c<\/i>. I <b>nema ograni\u010denja<\/b> na koli\u010dinu ovih podataka, samo svaki niz treba po\u010deti s <code>SSH-<\/code>.<\/p>\n<p>Ovo je ono \u010dime se bavi program Endlessh: on <b>\u0161alje <i>neprekidan<\/i> tok nasumi\u010dno generiranih podataka<\/b>, koji su u skladu s RFC 4253, tj. slanje prije identifikacije, a svaki niz po\u010dinje s <code>SSH-<\/code> i ne prelazi 255 znakova, uklju\u010duju\u0107i znak zavr\u0161etka niza. Ukratko, sve je po standardu.<\/p>\n<p>Po defaultu, program \u010deka 10 sekundi izme\u0111u slanja paketa. To sprje\u010dava isklju\u010denje zbog vremena \u010dekanja, tako da klijent zauvijek ostaje u zamci.<\/p>\n<p>Budu\u0107i da se podaci \u0161alju prije primjene kriptografije, program je iznimno jednostavan. Nema potrebe uklju\u010divati nikakve \u0161ifre i podr\u0161ku za brojne protokole.<\/p>\n<p>Autor se potrudili da alat konzumira minimalne resurse i radi potpuno neprimjetno na ra\u010dunalu. Za razliku od modernih antivirusnih programa i drugih \u201esigurnosnih sustava\u201c, ne bi trebao usporavati ra\u010dunal. Uspio je minimizirati i promet i potro\u0161nju memorije zahvaljuju\u0107i malo slo\u017eenijoj softverskoj realizaciji. Da je samo pokrenuo zaseban proces za novu vezu, potencijalni zlonamjernici mogli bi provesti DDoS napad otvaraju\u0107i brojne veze kako bi iscrpili resurse na ra\u010dalu. Jedan tok po vezi \u2013 tako\u0111er nije najbolja opcija, jer bi jezgra tro\u0161ila resurse na upravljanje tokovima.<\/p>\n<p>Stoga je Chris Velons odabrao za Endlessh najlak\u0161u opciju: jednonitni poslu\u017eitelj <code>poll(2)<\/code>, gdje klijenti u zamci gotovo ne tro\u0161e dodatne resurse, osim objekta socket u jezgri i jo\u0161 78 bajtova za pra\u0107enje u Endlessh. Kako ne bi odvajao preuzimanje i slanje jaslica za svakog klijenta, Endlessh otvara socket s izravnim pristupom i izravno prenosi TCP pakete, ignoriraju\u0107i gotovo cijeli TCP\/IP sloj operativnog sustava. Ulazni bafer uop\u0107e nije potreban, jer nas dolazni podaci ne zanimaju.<\/p>\n<p>Autor ka\u017ee da u trenutku izrade svog programa <noindex><a rel=\"nofollow\" href=\"https:\/\/nullprogram.com\/blog\/2019\/03\/10\/\">nije znao<\/a><\/noindex> za postojanje Pythonovog asycia i drugih trapa. Da je znao za asycio, mogao bi svoju korisnu aplikaciju implementirati u samo 18 redaka na Pythonu:<\/p>\n<pre><code class=\"python\">import asyncio\nimport random\n\nasync def handler(_reader, writer):\ntry:\nwhile True:\nawait asyncio.sleep(10)\nwriter.write(b'%xrn' % random.randint(0, 2**32))\nawait writer.drain()\nexcept ConnectionResetError:\npass\n\nasync def main():\nserver = await asyncio.start_server(handler, '0.0.0.0', 2222)\nasync with server:\nawait server.serve_forever()\n\nasyncio.run(main())<\/code><\/pre>\n<p>\nAsyncio je savr\u0161en za pisanje tarpitova. Na primjer, ovakva zamka mo\u017ee na dugotrajne sate blokirati Firefox, Chrome ili drugog klijenta koji se poku\u0161ava povezati na va\u0161 HTTP server:<\/p>\n<pre><code class=\"python\">import asyncio\nimport random\n\nasync def handler(_reader, writer):\nwriter.write(b'HTTP\/1.1 200 OKrn')\ntry:\nwhile True:\nawait asyncio.sleep(5)\nheader = random.randint(0, 2**32)\nvalue = random.randint(0, 2**32)\nwriter.write(b'X-%x: %xrn' % (header, value))\nawait writer.drain()\nexcept ConnectionResetError:\npass\n\nasync def main():\nserver = await asyncio.start_server(handler, '0.0.0.0', 8080)\nasync with server:\nawait server.serve_forever()\n\nasyncio.run(main())<\/code><\/pre>\n<p>\nTarpit je odli\u010dan alat za ka\u017enjavanje internet huligana. Ipak, postoji odre\u0111eni rizik da ih, umjesto toga, privu\u010de neobi\u010dno pona\u0161anje odre\u0111enog servera. Neko <noindex><a rel=\"nofollow\" href=\"https:\/\/news.ycombinator.com\/item?id=19466867\">mo\u017ee pomisliti na osvetu<\/a><\/noindex> i ciljana DDoS napad na va\u0161 IP. No, do sada nije bilo takvih slu\u010dajeva, i tarpiti dobro rade.<\/p>\n<p>Kategorije:<br \/>\nPython, Informati\u010dka sigurnost, Softver, Sistemska administracija<\/p>\n<p>Oznake:<br \/>\nSSH, Endlessh, tarpit, zamka, asyncio<br \/>\nZamka (tar pit) za ulazne SSH veze<\/p>\n<p>Nije tajna da je internet vrlo neprijateljsko okru\u017eenje. \u010cim podignete server, odmah je izlo\u017een masovnim napadima i brojnim skeniranjima. Na primjeru <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/436076\/\">honeypota od sigurnosnih stru\u010dnjaka<\/a><\/noindex> mo\u017ee se procijeniti razmjer ovog sme\u0161nog prometa. U stvari, na prosje\u010dnom serveru 99% prometa mo\u017ee biti zlonamjernog.<\/p>\n<p>Tarpit je port-zamka koja se koristi za usporavanje ulaznih veza. Ako se vanjski sustav pove\u017ee na ovu to\u010dku, ne\u0107e mo\u0107i brzo zatvoriti vezu. Mora tro\u0161iti svoje sistemske resurse i \u010dekati dok veza ne prekine zbog isteka vremena, ili je ru\u010dno prekinuti.<\/p>\n<p>Tarpiti se naj\u010de\u0161\u0107e koriste za za\u0161titu. Tehnika je prvotno razvijena za za\u0161titu od ra\u010dunalnih crva. A sada se mo\u017ee koristiti da bi se ote\u017eao \u017eivot spammerima i istra\u017eiva\u010dima koji se bave opse\u017enim skeniranjem svih IP adresa (primjeri na Habr: <noindex><a rel=\"nofollow\" href=\"https:\/\/blog.haschek.at\/2019\/i-scanned-austria.html\">Austrija<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/444490\/\">Ukrajina<\/a><\/noindex>).<\/p>\n<p>Jednom od sysadmina po imenu Chris Wellons, o\u010digledno je dosadilo promatrati ovu nepravdu \u2013 i napisao je mali program <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/skeeto\/endlessh\">Endlessh<\/a><\/noindex>, tarpit za SSH, koji usporava ulazne veze. Program otvara port (po defaultu je postavljen port 2222 za testiranje) i pretvara se da je SSH server, dok zapravo uspostavlja beskona\u010dnu vezu s ulaznim klijentom, sve dok ne odustane. To mo\u017ee trajati nekoliko dana ili vi\u0161e, sve dok klijent ne ispadne.<\/p>\n<p>Instalacija alata:<\/p>\n<pre><code class=\"bash\">$ make\n$ .\/endlessh &amp;\n$ ssh -p2222 localhost<\/code><\/pre>\n<p>\nIspravno implementiran tarpit oduzima vi\u0161e resursa napada\u010du nego vama. No, stvar nije samo u resursima. Autor <noindex><a rel=\"nofollow\" href=\"https:\/\/nullprogram.com\/blog\/2019\/03\/22\/\">pi\u0161e<\/a><\/noindex>, napominje da program izaziva ovisnost. Upravo sada u njegovoj zamci je 27 klijenata, neki od njih su povezani ve\u0107 tjednima. Na vrhuncu aktivnosti u zamci je bilo 1378 klijenata tijekom 20 sati!<\/p>\n<p>U operativnom re\u017eimu, server Endlessh treba postaviti na uobi\u010dajeni port 22, gdje se masovno poku\u0161avaju spojiti huligani. Standardne sigurnosne preporuke uvijek savjetuju premje\u0161tanje SSH na drugi port, \u0161to odmah znatno smanjuje veli\u010dinu logova.<\/p>\n<p>Chris Wellons ka\u017ee da njegov program iskori\u0161tava jedan pasus iz specifikacije <noindex><a rel=\"nofollow\" href=\"https:\/\/tools.ietf.org\/html\/rfc4253#section-4.2\">RFC 4253<\/a><\/noindex> za protokol SSH. Odmah nakon uspostavljanja TCP veze, ali prije primjene kriptografije, obje strane trebaju poslati identifikacijsku oznaku. I tamo je zabilje\u0161ka: <i>\u201ePoslu\u017eitelj MO\u017dE poslati druge nizove podataka prije slanja niza s verzijom\u201c<\/i>. I <b>nema ograni\u010denja<\/b> na koli\u010dinu ovih podataka, samo svaki niz treba po\u010deti s <code>SSH-<\/code>.<\/p>\n<p>Ovo je ono \u010dime se bavi program Endlessh: on <b>\u0161alje <i>neprekidan<\/i> tok nasumi\u010dno generiranih podataka<\/b>, koji su u skladu s RFC 4253, tj. slanje prije identifikacije, a svaki niz po\u010dinje s <code>SSH-<\/code> i ne prelazi 255 znakova, uklju\u010duju\u0107i znak zavr\u0161etka niza. Ukratko, sve je po standardu.<\/p>\n<p>Po defaultu, program \u010deka 10 sekundi izme\u0111u slanja paketa. To sprje\u010dava isklju\u010denje zbog vremena \u010dekanja, tako da klijent zauvijek ostaje u zamci.<\/p>\n<p>Budu\u0107i da se podaci \u0161alju prije primjene kriptografije, program je iznimno jednostavan. Nema potrebe uklju\u010divati nikakve \u0161ifre i podr\u0161ku za brojne protokole.<\/p>\n<p>Autor se potrudili da alat konzumira minimalne resurse i radi potpuno neprimjetno na ra\u010dunalu. Za razliku od modernih antivirusnih programa i drugih \u201esigurnosnih sustava\u201c, ne bi trebao usporavati ra\u010dunal. Uspio je minimizirati i promet i potro\u0161nju memorije zahvaljuju\u0107i malo slo\u017eenijoj softverskoj realizaciji. Da je samo pokrenuo zaseban proces za novu vezu, potencijalni zlonamjernici mogli bi provesti DDoS napad otvaraju\u0107i brojne veze kako bi iscrpili resurse na ra\u010dalu. Jedan tok po vezi \u2013 tako\u0111er nije najbolja opcija, jer bi jezgra tro\u0161ila resurse na upravljanje tokovima.<\/p>\n<p>Stoga je Chris Velons odabrao za Endlessh najlak\u0161u opciju: jednonitni poslu\u017eitelj <code>poll(2)<\/code>, gdje klijenti u zamci gotovo ne tro\u0161e dodatne resurse, osim objekta socket u jezgri i jo\u0161 78 bajtova za pra\u0107enje u Endlessh. Kako ne bi odvajao preuzimanje i slanje jaslica za svakog klijenta, Endlessh otvara socket s izravnim pristupom i izravno prenosi TCP pakete, ignoriraju\u0107i gotovo cijeli TCP\/IP sloj operativnog sustava. Ulazni bafer uop\u0107e nije potreban, jer nas dolazni podaci ne zanimaju.<\/p>\n<p>Autor ka\u017ee da u trenutku izrade svog programa <noindex><a rel=\"nofollow\" href=\"https:\/\/nullprogram.com\/blog\/2019\/03\/10\/\">nije znao<\/a><\/noindex> za postojanje Pythonovog asycia i drugih trapa. Da je znao za asycio, mogao bi svoju korisnu aplikaciju implementirati u samo 18 redaka na Pythonu:<\/p>\n<pre><code class=\"python\">import asyncio\nimport random\n\nasync def handler(_reader, writer):\n    try:\n        while True:\n            await asyncio.sleep(10)\n            writer.write(b'%xrn' % random.randint(0, 2**32))\n            await writer.drain()\n    except ConnectionResetError:\n        pass\n\nasync def main():\n    server = await asyncio.start_server(handler, '0.0.0.0', 2222)\n    async with server:\n        await server.serve_forever()\n\nasyncio.run(main())<\/code><\/pre>\n<p>\nAsyncio je savr\u0161en za pisanje tarpitova. Na primjer, ovakva zamka mo\u017ee na dugotrajne sate blokirati Firefox, Chrome ili drugog klijenta koji se poku\u0161ava povezati na va\u0161 HTTP server:<\/p>\n<pre><code class=\"python\">import asyncio\nimport random\n\nasync def handler(_reader, writer):\n    writer.write(b'HTTP\/1.1 200 OKrn')\n    try:\n        while True:\n            await asyncio.sleep(5)\n            header = random.randint(0, 2**32)\n            value = random.randint(0, 2**32)\n            writer.write(b'X-%x: %xrn' % (header, value))\n            await writer.drain()\n    except ConnectionResetError:\n        pass\n\nasync def main():\n    server = await asyncio.start_server(handler, '0.0.0.0', 8080)\n    async with server:\n        await server.serve_forever()\n\nasyncio.run(main())<\/code><\/pre>\n<p>\nTarpit je odli\u010dan alat za ka\u017enjavanje internet huligana. Ipak, postoji odre\u0111eni rizik da ih, umjesto toga, privu\u010de neobi\u010dno pona\u0161anje odre\u0111enog servera. Neko <noindex><a rel=\"nofollow\" href=\"https:\/\/news.ycombinator.com\/item?id=19466867\">mo\u017ee pomisliti na osvetu<\/a><\/noindex> i ciljana DDoS napad na va\u0161 IP. No, do sada nije bilo takvih slu\u010dajeva, i tarpiti dobro rade.<\/p>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/clck.ru\/EWJHw\"><img decoding=\"async\" alt=\"Zamka (tar pit) za ulazne SSH veze\" src=\"\/wp-content\/uploads\/2019\/03\/a1656e1e4a2ae612eaa58451579a488f.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><br \/>\n<br \/>Izvor: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/globalsign\/blog\/445318\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041d\u0435 \u0441\u0435\u043a\u0440\u0435\u0442, \u0447\u0442\u043e \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u2014 \u043e\u0447\u0435\u043d\u044c \u0432\u0440\u0430\u0436\u0434\u0435\u0431\u043d\u0430\u044f \u0441\u0440\u0435\u0434\u0430. \u041a\u0430\u043a \u0442\u043e\u043b\u044c\u043a\u043e \u0432\u044b \u043f\u043e\u0434\u043d\u0438\u043c\u0430\u0435\u0442\u0435 \u0441\u0435\u0440\u0432\u0435\u0440, \u043e\u043d \u043c\u0433\u043d\u043e\u0432\u0435\u043d\u043d\u043e \u043f\u043e\u0434\u0432\u0435\u0440\u0433\u0430\u0435\u0442\u0441\u044f \u043c\u0430\u0441\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0430\u0442\u0430\u043a\u0430\u043c \u0438 \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u043c \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f\u043c. \u041d\u0430 \u043f\u0440\u0438\u043c\u0435\u0440\u0435 \u0445\u0430\u043d\u0438\u043f\u043e\u0442\u0430 \u043e\u0442 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0438\u043a\u043e\u0432 \u043c\u043e\u0436\u043d\u043e \u043e\u0446\u0435\u043d\u0438\u0442\u044c \u043c\u0430\u0441\u0448\u0442\u0430\u0431 \u044d\u0442\u043e\u0433\u043e \u043c\u0443\u0441\u043e\u0440\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430. \u0424\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438, \u043d\u0430 \u0441\u0440\u0435\u0434\u043d\u0435\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 99% \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c. Tarpit \u2014 \u044d\u0442\u043e \u043f\u043e\u0440\u0442-\u043b\u043e\u0432\u0443\u0448\u043a\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u0437\u0430\u043c\u0435\u0434\u043b\u0435\u043d\u0438\u044f \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0445 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439. \u0415\u0441\u043b\u0438 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u044f\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-30312","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041d\u0435 \u0441\u0435\u043a\u0440\u0435\u0442, \u0447\u0442\u043e \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u2014 \u043e\u0447\u0435\u043d\u044c \u0432\u0440\u0430\u0436\u0434\u0435\u0431\u043d\u0430\u044f \u0441\u0440\u0435\u0434\u0430. \u041a\u0430\u043a \u0442\u043e\u043b\u044c\u043a\u043e \u0432\u044b \u043f\u043e\u0434\u043d\u0438\u043c\u0430\u0435\u0442\u0435 \u0441\u0435\u0440\u0432\u0435\u0440, \u043e\u043d \u043c\u0433\u043d\u043e\u0432\u0435\u043d\u043d\u043e \u043f\u043e\u0434\u0432\u0435\u0440\u0433\u0430\u0435\u0442\u0441\u044f \u043c\u0430\u0441\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0430\u0442\u0430\u043a\u0430\u043c \u0438 \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u043c \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f\u043c.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/hr\/blog\/lovushka-tarpit-dlya-vhodyashhih-ssh-soedinenij\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"hr_HR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041b\u043e\u0432\u0443\u0448\u043a\u0430 (\u0442\u0430\u0440\u043f\u0438\u0442) \u0434\u043b\u044f \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0445 SSH-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041d\u0435 \u0441\u0435\u043a\u0440\u0435\u0442, \u0447\u0442\u043e \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u2014 \u043e\u0447\u0435\u043d\u044c \u0432\u0440\u0430\u0436\u0434\u0435\u0431\u043d\u0430\u044f \u0441\u0440\u0435\u0434\u0430. \u041a\u0430\u043a \u0442\u043e\u043b\u044c\u043a\u043e \u0432\u044b \u043f\u043e\u0434\u043d\u0438\u043c\u0430\u0435\u0442\u0435 \u0441\u0435\u0440\u0432\u0435\u0440, \u043e\u043d \u043c\u0433\u043d\u043e\u0432\u0435\u043d\u043d\u043e \u043f\u043e\u0434\u0432\u0435\u0440\u0433\u0430\u0435\u0442\u0441\u044f \u043c\u0430\u0441\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0430\u0442\u0430\u043a\u0430\u043c \u0438 \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u043c \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f\u043c.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/hr\/blog\/lovushka-tarpit-dlya-vhodyashhih-ssh-soedinenij\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:34:49+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:34:49+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zamka (tarpit) za dolazne SSH veze | ProHoster","description":"Nije tajna da je internet vrlo neprijateljsko okru\u017eenje. \u010cim podignete server, on odmah postaje mete masovnih napada i brojnih skeniranja.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/lovushka-tarpit-dlya-vhodyashhih-ssh-soedinenij","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041b\u043e\u0432\u0443\u0448\u043a\u0430 (\u0442\u0430\u0440\u043f\u0438\u0442) \u0434\u043b\u044f \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0445 SSH-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439 | ProHoster","og:description":"\u041d\u0435 \u0441\u0435\u043a\u0440\u0435\u0442, \u0447\u0442\u043e \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u2014 \u043e\u0447\u0435\u043d\u044c \u0432\u0440\u0430\u0436\u0434\u0435\u0431\u043d\u0430\u044f \u0441\u0440\u0435\u0434\u0430. \u041a\u0430\u043a \u0442\u043e\u043b\u044c\u043a\u043e \u0432\u044b \u043f\u043e\u0434\u043d\u0438\u043c\u0430\u0435\u0442\u0435 \u0441\u0435\u0440\u0432\u0435\u0440, \u043e\u043d \u043c\u0433\u043d\u043e\u0432\u0435\u043d\u043d\u043e \u043f\u043e\u0434\u0432\u0435\u0440\u0433\u0430\u0435\u0442\u0441\u044f \u043c\u0430\u0441\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0430\u0442\u0430\u043a\u0430\u043c \u0438 \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u043c \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f\u043c.","og:url":"https:\/\/prohoster.info\/hr\/blog\/lovushka-tarpit-dlya-vhodyashhih-ssh-soedinenij","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:34:49+00:00","article:modified_time":"2019-10-31T18:34:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"30312","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 00:38:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:37:27","updated":"2026-01-21 00:38:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/30312","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=30312"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/30312\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=30312"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=30312"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=30312"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}