{"id":30312,"date":"2019-10-31T21:34:49","date_gmt":"2019-10-31T18:34:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/lovushka-tarpit-dlya-vhodyashhih-ssh-soedinenij\/"},"modified":"2019-10-31T21:34:49","modified_gmt":"2019-10-31T18:34:49","slug":"lovushka-tarpit-dlya-vhodyashhih-ssh-soedinenij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/lovushka-tarpit-dlya-vhodyashhih-ssh-soedinenij","title":{"rendered":"Kapja (tarpit) p\u00ebr lidhjet hyr\u00ebse SSH","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Nuk \u00ebsht\u00eb sekret q\u00eb interneti \u00ebsht\u00eb nj\u00eb ambient shum\u00eb armiq\u00ebsor. Sapo t\u00eb ngrini nj\u00eb server, ai menj\u00ebher\u00eb p\u00ebrballohet me sulme masive dhe skanime t\u00eb shumta. Nga shembulli i honeypot-it t\u00eb siguris\u00eb<\/a><\/noindex> mund t\u00eb vler\u00ebsohet shkalla e k\u00ebtij trafiku t\u00eb panevojsh\u00ebm. N\u00eb fakt, n\u00eb nj\u00eb server mesatar 99% e trafik \u00ebsht\u00eb potencialisht i d\u00ebmsh\u00ebm.<\/p>\n

Tarpit \u00ebsht\u00eb nj\u00eb port-kap\u00ebs q\u00eb p\u00ebrdoret p\u00ebr t\u00eb ngadal\u00ebsuar lidhjet hyr\u00ebse. N\u00ebse nj\u00eb sistem tjet\u00ebr lidhet me k\u00ebt\u00eb port, nuk do t\u00eb jet\u00eb e leht\u00eb ta mbyll\u00ebsh lidhjen shpejt. Ai do t\u00eb duhet t\u00eb shpenzoj\u00eb burimet e tij sistemore dhe t\u00eb pres\u00eb deri sa lidhja t\u00eb nd\u00ebrpritet p\u00ebrmes nj\u00eb koha t\u00eb skadimit, ose ta ndaloj\u00eb at\u00eb manuelisht.<\/p>\n

S\u00eb shumti, tarpitat p\u00ebrdoren p\u00ebr mbrojtje. Kjo teknik\u00eb u zhvillua nga fillimi p\u00ebr t\u00eb mbrojtur nga t\u00ebrmetet kompjuterike. Tani mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb prishur jet\u00ebn spamer\u00ebve dhe hulumtuesve q\u00eb b\u00ebjn\u00eb skanime t\u00eb gjera t\u00eb t\u00eb gjith\u00eb IP-ve nj\u00ebpasnj\u00ebrisht (shembuj n\u00eb Habra: Austria<\/a><\/noindex>, Ukrain\u00eb<\/a><\/noindex>).
\n<\/a><\/noindex>
\nNj\u00eb administratori t\u00eb sistemit i quajtur Kris Velons, duket se i \u00ebsht\u00eb b\u00ebr\u00eb m\u00ebrzi t\u00eb v\u00ebzhgoj\u00eb k\u00ebt\u00eb kaos \u2014 dhe ai shkroi nj\u00eb program t\u00eb vog\u00ebl Endlessh<\/a><\/noindex>, nj\u00eb tarpit p\u00ebr SSH, i cili ngadal\u00ebson lidhjet hyr\u00ebse. Ky program hap nj\u00eb port (p\u00ebr testim, porti 2222 \u00ebsht\u00eb specificuar si standart) dhe pretendon se \u00ebsht\u00eb nj\u00eb server SSH, nd\u00ebrsa n\u00eb t\u00eb v\u00ebrtet\u00eb vendos nj\u00eb lidhje t\u00eb pafund me klientin hyr\u00ebs, derisa ai t\u00eb dor\u00ebzohet. Kjo mund t\u00eb vazhdoj\u00eb p\u00ebr disa dit\u00eb ose m\u00eb shum\u00eb, derisa klienti t\u00eb largohet.<\/p>\n

Instalimi i utilitarit:<\/p>\n

$ make\n$ .\/endlessh &\n$ ssh -p2222 localhost<\/code><\/pre>\n
\nTarpiti i implementuar si\u00e7 duhet do t'i marr\u00eb m\u00eb shum\u00eb burime sulmuesve sesa ju. Por \u00e7\u00ebshtja nuk \u00ebsht\u00eb vet\u00ebm te burimet. Autori raporton<\/a><\/noindex>, q\u00eb programi krijon var\u00ebsi. Tani p\u00ebr tani n\u00eb grack\u00ebn e tij ka 27 klient\u00eb, disa prej t\u00eb cil\u00ebve jan\u00eb lidhur p\u00ebr jav\u00eb. N\u00eb kulmin e aktivitetit, n\u00eb grack\u00eb ishin 1378 klient\u00eb p\u00ebr 20 or\u00eb!<\/p>\n
N\u00eb funksionim, serveri Endlessh duhet vendosur n\u00eb portin standard 22, ku t\u00eb dhunojn\u00eb shum\u00eb hajnij. Rekomandimet standarde p\u00ebr siguri gjithmon\u00eb sugjerojn\u00eb t\u00eb zhvendosni SSH n\u00eb nj\u00eb port tjet\u00ebr, gj\u00eb q\u00eb menj\u00ebher\u00eb zvog\u00eblon numrin e regjistrimeve.<\/p>\n
Kris Velons thot\u00eb se programi i tij shfryt\u00ebzon nj\u00eb paragraf nga specifikimi RFC 4253<\/a><\/noindex> p\u00ebr protokolimin SSH. Menj\u00ebher\u00eb pas krijimit t\u00eb lidhjes TCP, por para zbatimit t\u00eb kriptografis\u00eb, t\u00eb dy pal\u00ebt duhet t\u00eb d\u00ebrgojn\u00eb nj\u00eb string identifikues. Dhe aty \u00ebsht\u00eb nj\u00eb sh\u00ebnim: \u00abServeri MUND t\u00eb d\u00ebrgoj\u00eb t\u00eb dh\u00ebna t\u00eb tjera para se t\u00eb d\u00ebrgoj\u00eb stringun me versionin\u00bb<\/i>. Dhe . Dhe<\/b> nuk ka kufizim n\u00eb volumet e k\u00ebtyre t\u00eb dh\u00ebnave, thjesht \u00e7do string duhet t\u00eb filloj\u00eb me<\/code>.<\/p>\n
SSH- d\u00ebrgon d\u00ebrgon<\/i> nj\u00eb fluks t\u00eb pafund t\u00eb t\u00eb dh\u00ebnave t\u00eb gjeneruara rast\u00ebsisht,<\/b>t\u00eb cilat i p\u00ebrmbajn\u00eb RFC 4253, dometh\u00ebn\u00eb, d\u00ebrgimi para identifikimit, dhe \u00e7do string fillon me n\u00eb volumet e k\u00ebtyre t\u00eb dh\u00ebnave, thjesht \u00e7do string duhet t\u00eb filloj\u00eb me<\/code> dhe nuk kalon 255 karaktere, duke p\u00ebrfshir\u00eb karakterin e p\u00ebrfundimit t\u00eb stringut. N\u00eb p\u00ebrgjith\u00ebsi, gjith\u00e7ka sipas standardit.<\/p>\n
Me standart, programi pret 10 sekonda mes d\u00ebrgimeve t\u00eb paketeve. Kjo parandalon nd\u00ebrprerjen p\u00ebr shkak t\u00eb skadimit, k\u00ebshtu q\u00eb klienti do t\u00eb q\u00ebndroj\u00eb n\u00eb grack\u00eb p\u00ebr gjithmon\u00eb.<\/p>\n
Duke qen\u00eb se d\u00ebrgimi i t\u00eb dh\u00ebnave b\u00ebhet para zbatimit t\u00eb kriptografis\u00eb, programi \u00ebsht\u00eb jasht\u00ebzakonisht i thjesht\u00eb. Nuk ka nevoj\u00eb t\u00eb p\u00ebrfshij\u00eb ndonj\u00eb enkriptim dhe mb\u00ebshtetje p\u00ebr shum\u00eb protokolle.<\/p>\n
Autori ka b\u00ebr\u00eb p\u00ebrpjekje q\u00eb utilitari t\u00eb konsumoj\u00eb sa m\u00eb pak burime dhe t\u00eb punoj\u00eb plot\u00ebsisht pa u v\u00ebn\u00eb re n\u00eb makin\u00eb. N\u00eb kontrast me antivirus\u00ebt modern\u00eb dhe sistemet e tjera t\u00eb \"siguris\u00eb\", ai nuk duhet ta ngadal\u00ebsoj\u00eb kompjuterin. Ai arriti ta minimalizoj\u00eb si trafikun ashtu edhe konsumimin e memories p\u00ebrmes nj\u00eb realizimi pak m\u00eb t\u00eb zgjuar programor. N\u00ebse ai do t\u00eb hapte ve\u00e7mas nj\u00eb proces p\u00ebr \u00e7do lidhje, at\u00ebher\u00eb potencialet e keqb\u00ebr\u00ebsve mund t\u00eb nd\u00ebrmerrnin nj\u00eb sulm DDoS duke hapur shum\u00eb lidhje p\u00ebr t\u00eb shteruar burimet n\u00eb makin\u00eb. Nj\u00eb rrjedh\u00eb p\u00ebr lidhje \u2014 gjithashtu nuk \u00ebsht\u00eb opsioni m\u00eb i mir\u00eb, sepse b\u00ebrthama do t\u00eb shpenzoj\u00eb burime p\u00ebr menaxhimin e rrjedhave.<\/p>\n
Prandaj, Kris Velons zgjodhi opsionin m\u00eb t\u00eb leht\u00eb p\u00ebr Endlessh: nj\u00eb server me nj\u00eb rrjedh\u00eb poll(2)<\/code>, ku klient\u00ebt n\u00eb grack\u00eb praktikisht nuk konsumojn\u00eb burime shtes\u00eb, p\u00ebrve\u00e7 objektit t\u00eb socket-it n\u00eb b\u00ebrtham\u00eb dhe 78 byteve p\u00ebr ndjekjen n\u00eb Endlessh. P\u00ebr t\u00eb mos ndar\u00eb buferat e pranimit dhe d\u00ebrgimit p\u00ebr \u00e7do klient, Endlessh hap nj\u00eb socket t\u00eb qasjes direkte dhe transmeton drejtp\u00ebrdrejt paketat TCP, duke injoruar pothuajse gjith\u00eb steak TCP\/IP t\u00eb sistemit operativ. Bufferi hyr\u00ebs nuk \u00ebsht\u00eb i nevojsh\u00ebm fare, sepse t\u00eb dh\u00ebnat hyr\u00ebse nuk na interesojn\u00eb.<\/p>\n
Autori thot\u00eb se n\u00eb momentin e krijimit t\u00eb programit t\u00eb tij nuk e dinte<\/a><\/noindex> p\u00ebr ekzistenc\u00ebn e asycio t\u00eb Python-it dhe tarpit\u00ebve t\u00eb tjer\u00eb. N\u00ebse ai do ta dinte p\u00ebr asycio, at\u00ebher\u00eb utilitarin e tij do ta implementonte n\u00eb vet\u00ebm 18 rreshta n\u00eb Python:<\/p>\n
import asyncio\nimport random\n\nasync def handler(_reader, writer):\ntry:\nwhile True:\nawait asyncio.sleep(10)\nwriter.write(b'%xrn' % random.randint(0, 2**32))\nawait writer.drain()\nexcept ConnectionResetError:\npass\n\nasync def main():\nserver = await asyncio.start_server(handler, '0.0.0.0', 2222)\nasync with server:\nawait server.serve_forever()\n\nasyncio.run(main())<\/code><\/pre>\n
\nAsyncio \u00ebsht\u00eb ideal p\u00ebr t\u00eb shkruar tarpitu. P\u00ebr shembull, nj\u00eb tullumbace e till\u00eb mund t\u00eb bllokoj\u00eb Firefox, Chrome ose \u00e7do klient tjet\u00ebr q\u00eb p\u00ebrpiqet t\u00eb conectohet me serverin tuaj HTTP:<\/p>\n
import asyncio\nimport random\n\nasync def handler(_reader, writer):\nwriter.write(b'HTTP\/1.1 200 OKrn')\ntry:\nwhile True:\nawait asyncio.sleep(5)\nheader = random.randint(0, 2**32)\nvalue = random.randint(0, 2**32)\nwriter.write(b'X-%x: %xrn' % (header, value))\nawait writer.drain()\nexcept ConnectionResetError:\npass\n\nasync def main():\nserver = await asyncio.start_server(handler, '0.0.0.0', 8080)\nasync with server:\nawait server.serve_forever()\n\nasyncio.run(main())<\/code><\/pre>\n
\nTarpit \u00ebsht\u00eb nj\u00eb mjet i shk\u00eblqyer p\u00ebr t\u00eb nd\u00ebshkuar internet-hajdut\u00ebt. Megjithat\u00eb, ka nj\u00eb rrezik q\u00eb mund t\u00eb t\u00ebrheq\u00eb v\u00ebmendjen e tyre p\u00ebr sjelljen e pazakont\u00eb t\u00eb nj\u00eb serveri t\u00eb caktuar. Disa mund t\u00eb mendojn\u00eb p\u00ebr hakmarrje<\/a><\/noindex> dhe nj\u00eb sulm DDoS t\u00eb drejtuar ndaj IP-s\u00eb tuaj. Megjithat\u00eb, deri tani ka pasur pak raste t\u00eb tilla, dhe tarpitet funksionojn\u00eb shk\u00eblqyesh\u00ebm.<\/p>\n
Hubet:
\nPython, Siguria e informacionit, Softuer, Administrimi i sistemeve<\/p>\n
Etiketat:
\nSSH, Endlessh, tarpit, tullumbace, asyncio
\nKapja (tarpit) p\u00ebr lidhjet hyr\u00ebse SSH<\/p>\n
Nuk \u00ebsht\u00eb sekret q\u00eb interneti \u00ebsht\u00eb nj\u00eb ambient shum\u00eb armiq\u00ebsor. Sapo t\u00eb ngrini nj\u00eb server, ai menj\u00ebher\u00eb p\u00ebrballohet me sulme masive dhe skanime t\u00eb shumta. Nga shembulli i honeypot-it t\u00eb siguris\u00eb<\/a><\/noindex> mund t\u00eb vler\u00ebsohet shkalla e k\u00ebtij trafiku t\u00eb panevojsh\u00ebm. N\u00eb fakt, n\u00eb nj\u00eb server mesatar 99% e trafik \u00ebsht\u00eb potencialisht i d\u00ebmsh\u00ebm.<\/p>\n
Tarpit \u00ebsht\u00eb nj\u00eb port-kap\u00ebs q\u00eb p\u00ebrdoret p\u00ebr t\u00eb ngadal\u00ebsuar lidhjet hyr\u00ebse. N\u00ebse nj\u00eb sistem tjet\u00ebr lidhet me k\u00ebt\u00eb port, nuk do t\u00eb jet\u00eb e leht\u00eb ta mbyll\u00ebsh lidhjen shpejt. Ai do t\u00eb duhet t\u00eb shpenzoj\u00eb burimet e tij sistemore dhe t\u00eb pres\u00eb deri sa lidhja t\u00eb nd\u00ebrpritet p\u00ebrmes nj\u00eb koha t\u00eb skadimit, ose ta ndaloj\u00eb at\u00eb manuelisht.<\/p>\n
S\u00eb shumti, tarpitat p\u00ebrdoren p\u00ebr mbrojtje. Kjo teknik\u00eb u zhvillua nga fillimi p\u00ebr t\u00eb mbrojtur nga t\u00ebrmetet kompjuterike. Tani mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb prishur jet\u00ebn spamer\u00ebve dhe hulumtuesve q\u00eb b\u00ebjn\u00eb skanime t\u00eb gjera t\u00eb t\u00eb gjith\u00eb IP-ve nj\u00ebpasnj\u00ebrisht (shembuj n\u00eb Habra: Austria<\/a><\/noindex>, Ukrain\u00eb<\/a><\/noindex>).<\/p>\n
Nj\u00eb administratori t\u00eb sistemit i quajtur Kris Velons, duket se i \u00ebsht\u00eb b\u00ebr\u00eb m\u00ebrzi t\u00eb v\u00ebzhgoj\u00eb k\u00ebt\u00eb kaos \u2014 dhe ai shkroi nj\u00eb program t\u00eb vog\u00ebl Endlessh<\/a><\/noindex>, nj\u00eb tarpit p\u00ebr SSH, i cili ngadal\u00ebson lidhjet hyr\u00ebse. Ky program hap nj\u00eb port (p\u00ebr testim, porti 2222 \u00ebsht\u00eb specificuar si standart) dhe pretendon se \u00ebsht\u00eb nj\u00eb server SSH, nd\u00ebrsa n\u00eb t\u00eb v\u00ebrtet\u00eb vendos nj\u00eb lidhje t\u00eb pafund me klientin hyr\u00ebs, derisa ai t\u00eb dor\u00ebzohet. Kjo mund t\u00eb vazhdoj\u00eb p\u00ebr disa dit\u00eb ose m\u00eb shum\u00eb, derisa klienti t\u00eb largohet.<\/p>\n
Instalimi i utilitarit:<\/p>\n
$ make\n$ .\/endlessh &\n$ ssh -p2222 localhost<\/code><\/pre>\n
\nTarpiti i implementuar si\u00e7 duhet do t'i marr\u00eb m\u00eb shum\u00eb burime sulmuesve sesa ju. Por \u00e7\u00ebshtja nuk \u00ebsht\u00eb vet\u00ebm te burimet. Autori raporton<\/a><\/noindex>, q\u00eb programi krijon var\u00ebsi. Tani p\u00ebr tani n\u00eb grack\u00ebn e tij ka 27 klient\u00eb, disa prej t\u00eb cil\u00ebve jan\u00eb lidhur p\u00ebr jav\u00eb. N\u00eb kulmin e aktivitetit, n\u00eb grack\u00eb ishin 1378 klient\u00eb p\u00ebr 20 or\u00eb!<\/p>\n
N\u00eb funksionim, serveri Endlessh duhet vendosur n\u00eb portin standard 22, ku t\u00eb dhunojn\u00eb shum\u00eb hajnij. Rekomandimet standarde p\u00ebr siguri gjithmon\u00eb sugjerojn\u00eb t\u00eb zhvendosni SSH n\u00eb nj\u00eb port tjet\u00ebr, gj\u00eb q\u00eb menj\u00ebher\u00eb zvog\u00eblon numrin e regjistrimeve.<\/p>\n
Kris Velons thot\u00eb se programi i tij shfryt\u00ebzon nj\u00eb paragraf nga specifikimi RFC 4253<\/a><\/noindex> p\u00ebr protokolimin SSH. Menj\u00ebher\u00eb pas krijimit t\u00eb lidhjes TCP, por para zbatimit t\u00eb kriptografis\u00eb, t\u00eb dy pal\u00ebt duhet t\u00eb d\u00ebrgojn\u00eb nj\u00eb string identifikues. Dhe aty \u00ebsht\u00eb nj\u00eb sh\u00ebnim: \u00abServeri MUND t\u00eb d\u00ebrgoj\u00eb t\u00eb dh\u00ebna t\u00eb tjera para se t\u00eb d\u00ebrgoj\u00eb stringun me versionin\u00bb<\/i>. Dhe . Dhe<\/b> nuk ka kufizim n\u00eb volumet e k\u00ebtyre t\u00eb dh\u00ebnave, thjesht \u00e7do string duhet t\u00eb filloj\u00eb me<\/code>.<\/p>\n
SSH- d\u00ebrgon d\u00ebrgon<\/i> nj\u00eb fluks t\u00eb pafund t\u00eb t\u00eb dh\u00ebnave t\u00eb gjeneruara rast\u00ebsisht,<\/b>t\u00eb cilat i p\u00ebrmbajn\u00eb RFC 4253, dometh\u00ebn\u00eb, d\u00ebrgimi para identifikimit, dhe \u00e7do string fillon me n\u00eb volumet e k\u00ebtyre t\u00eb dh\u00ebnave, thjesht \u00e7do string duhet t\u00eb filloj\u00eb me<\/code> dhe nuk kalon 255 karaktere, duke p\u00ebrfshir\u00eb karakterin e p\u00ebrfundimit t\u00eb stringut. N\u00eb p\u00ebrgjith\u00ebsi, gjith\u00e7ka sipas standardit.<\/p>\n
Me standart, programi pret 10 sekonda mes d\u00ebrgimeve t\u00eb paketeve. Kjo parandalon nd\u00ebrprerjen p\u00ebr shkak t\u00eb skadimit, k\u00ebshtu q\u00eb klienti do t\u00eb q\u00ebndroj\u00eb n\u00eb grack\u00eb p\u00ebr gjithmon\u00eb.<\/p>\n
Duke qen\u00eb se d\u00ebrgimi i t\u00eb dh\u00ebnave b\u00ebhet para zbatimit t\u00eb kriptografis\u00eb, programi \u00ebsht\u00eb jasht\u00ebzakonisht i thjesht\u00eb. Nuk ka nevoj\u00eb t\u00eb p\u00ebrfshij\u00eb ndonj\u00eb enkriptim dhe mb\u00ebshtetje p\u00ebr shum\u00eb protokolle.<\/p>\n
Autori ka b\u00ebr\u00eb p\u00ebrpjekje q\u00eb utilitari t\u00eb konsumoj\u00eb sa m\u00eb pak burime dhe t\u00eb punoj\u00eb plot\u00ebsisht pa u v\u00ebn\u00eb re n\u00eb makin\u00eb. N\u00eb kontrast me antivirus\u00ebt modern\u00eb dhe sistemet e tjera t\u00eb \"siguris\u00eb\", ai nuk duhet ta ngadal\u00ebsoj\u00eb kompjuterin. Ai arriti ta minimalizoj\u00eb si trafikun ashtu edhe konsumimin e memories p\u00ebrmes nj\u00eb realizimi pak m\u00eb t\u00eb zgjuar programor. N\u00ebse ai do t\u00eb hapte ve\u00e7mas nj\u00eb proces p\u00ebr \u00e7do lidhje, at\u00ebher\u00eb potencialet e keqb\u00ebr\u00ebsve mund t\u00eb nd\u00ebrmerrnin nj\u00eb sulm DDoS duke hapur shum\u00eb lidhje p\u00ebr t\u00eb shteruar burimet n\u00eb makin\u00eb. Nj\u00eb rrjedh\u00eb p\u00ebr lidhje \u2014 gjithashtu nuk \u00ebsht\u00eb opsioni m\u00eb i mir\u00eb, sepse b\u00ebrthama do t\u00eb shpenzoj\u00eb burime p\u00ebr menaxhimin e rrjedhave.<\/p>\n
Prandaj, Kris Velons zgjodhi opsionin m\u00eb t\u00eb leht\u00eb p\u00ebr Endlessh: nj\u00eb server me nj\u00eb rrjedh\u00eb poll(2)<\/code>, ku klient\u00ebt n\u00eb grack\u00eb praktikisht nuk konsumojn\u00eb burime shtes\u00eb, p\u00ebrve\u00e7 objektit t\u00eb socket-it n\u00eb b\u00ebrtham\u00eb dhe 78 byteve p\u00ebr ndjekjen n\u00eb Endlessh. P\u00ebr t\u00eb mos ndar\u00eb buferat e pranimit dhe d\u00ebrgimit p\u00ebr \u00e7do klient, Endlessh hap nj\u00eb socket t\u00eb qasjes direkte dhe transmeton drejtp\u00ebrdrejt paketat TCP, duke injoruar pothuajse gjith\u00eb steak TCP\/IP t\u00eb sistemit operativ. Bufferi hyr\u00ebs nuk \u00ebsht\u00eb i nevojsh\u00ebm fare, sepse t\u00eb dh\u00ebnat hyr\u00ebse nuk na interesojn\u00eb.<\/p>\n
Autori thot\u00eb se n\u00eb momentin e krijimit t\u00eb programit t\u00eb tij nuk e dinte<\/a><\/noindex> p\u00ebr ekzistenc\u00ebn e asycio t\u00eb Python-it dhe tarpit\u00ebve t\u00eb tjer\u00eb. N\u00ebse ai do ta dinte p\u00ebr asycio, at\u00ebher\u00eb utilitarin e tij do ta implementonte n\u00eb vet\u00ebm 18 rreshta n\u00eb Python:<\/p>\n
import asyncio\nimport random\n\nasync def handler(_reader, writer):\n    try:\n        while True:\n            await asyncio.sleep(10)\n            writer.write(b'%xrn' % random.randint(0, 2**32))\n            await writer.drain()\n    except ConnectionResetError:\n        pass\n\nasync def main():\n    server = await asyncio.start_server(handler, '0.0.0.0', 2222)\n    async with server:\n        await server.serve_forever()\n\nasyncio.run(main())<\/code><\/pre>\n
\nAsyncio \u00ebsht\u00eb ideal p\u00ebr t\u00eb shkruar tarpitu. P\u00ebr shembull, nj\u00eb tullumbace e till\u00eb mund t\u00eb bllokoj\u00eb Firefox, Chrome ose \u00e7do klient tjet\u00ebr q\u00eb p\u00ebrpiqet t\u00eb conectohet me serverin tuaj HTTP:<\/p>\n
import asyncio\nimport random\n\nasync def handler(_reader, writer):\n    writer.write(b'HTTP\/1.1 200 OKrn')\n    try:\n        while True:\n            await asyncio.sleep(5)\n            header = random.randint(0, 2**32)\n            value = random.randint(0, 2**32)\n            writer.write(b'X-%x: %xrn' % (header, value))\n            await writer.drain()\n    except ConnectionResetError:\n        pass\n\nasync def main():\n    server = await asyncio.start_server(handler, '0.0.0.0', 8080)\n    async with server:\n        await server.serve_forever()\n\nasyncio.run(main())<\/code><\/pre>\n
\nTarpit \u00ebsht\u00eb nj\u00eb mjet i shk\u00eblqyer p\u00ebr t\u00eb nd\u00ebshkuar internet-hajdut\u00ebt. Megjithat\u00eb, ka nj\u00eb rrezik q\u00eb mund t\u00eb t\u00ebrheq\u00eb v\u00ebmendjen e tyre p\u00ebr sjelljen e pazakont\u00eb t\u00eb nj\u00eb serveri t\u00eb caktuar. Disa mund t\u00eb mendojn\u00eb p\u00ebr hakmarrje<\/a><\/noindex> dhe nj\u00eb sulm DDoS t\u00eb drejtuar ndaj IP-s\u00eb tuaj. Megjithat\u00eb, deri tani ka pasur pak raste t\u00eb tilla, dhe tarpitet funksionojn\u00eb shk\u00eblqyesh\u00ebm.<\/p>\n
\n\"Kapja<\/a><\/noindex>
\n
Burimi: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u041d\u0435 \u0441\u0435\u043a\u0440\u0435\u0442, \u0447\u0442\u043e \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u2014 \u043e\u0447\u0435\u043d\u044c \u0432\u0440\u0430\u0436\u0434\u0435\u0431\u043d\u0430\u044f \u0441\u0440\u0435\u0434\u0430. \u041a\u0430\u043a \u0442\u043e\u043b\u044c\u043a\u043e \u0432\u044b \u043f\u043e\u0434\u043d\u0438\u043c\u0430\u0435\u0442\u0435 \u0441\u0435\u0440\u0432\u0435\u0440, \u043e\u043d \u043c\u0433\u043d\u043e\u0432\u0435\u043d\u043d\u043e \u043f\u043e\u0434\u0432\u0435\u0440\u0433\u0430\u0435\u0442\u0441\u044f \u043c\u0430\u0441\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0430\u0442\u0430\u043a\u0430\u043c \u0438 \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u043c \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f\u043c. \u041d\u0430 \u043f\u0440\u0438\u043c\u0435\u0440\u0435 \u0445\u0430\u043d\u0438\u043f\u043e\u0442\u0430 \u043e\u0442 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0438\u043a\u043e\u0432 \u043c\u043e\u0436\u043d\u043e \u043e\u0446\u0435\u043d\u0438\u0442\u044c \u043c\u0430\u0441\u0448\u0442\u0430\u0431 \u044d\u0442\u043e\u0433\u043e \u043c\u0443\u0441\u043e\u0440\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430. \u0424\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438, \u043d\u0430 \u0441\u0440\u0435\u0434\u043d\u0435\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 99% \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c. Tarpit \u2014 \u044d\u0442\u043e \u043f\u043e\u0440\u0442-\u043b\u043e\u0432\u0443\u0448\u043a\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u0437\u0430\u043c\u0435\u0434\u043b\u0435\u043d\u0438\u044f \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0445 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439. \u0415\u0441\u043b\u0438 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u044f\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-30312","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Tullumbace (tarpit) p\u00ebr lidhjet SSH t\u00eb ardhshme | ProHoster","description":"Nuk \u00ebsht\u00eb sekret q\u00eb interneti \u00ebsht\u00eb nj\u00eb mjedis shum\u00eb armiq\u00ebsor. Sa her\u00eb q\u00eb ngrini nj\u00eb server, ai menj\u00ebher\u00eb i n\u00ebnshtrohet sulmeve masive dhe skanimeve t\u00eb shumta. Duke p\u00ebrdorur nj\u00eb honeypot nga siguris\u00eb, mund t\u00eb vler\u00ebsoni shkall\u00ebn e k\u00ebtij trafiku t\u00eb pad\u00ebshiruesh\u00ebm. N\u00eb fakt, n\u00eb nj\u00eb server mesatar, 99% e trafikut mund t\u00eb jet\u00eb i d\u00ebmsh\u00ebm. Tarpit \u00ebsht\u00eb nj\u00eb gryk\u00eb porti q\u00eb p\u00ebrdoret p\u00ebr t\u00eb ngadal\u00ebsuar lidhjet e ardhshme. N\u00ebse nj\u00eb sistem i jasht\u00ebm connectohet","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/lovushka-tarpit-dlya-vhodyashhih-ssh-soedinenij","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041b\u043e\u0432\u0443\u0448\u043a\u0430 (\u0442\u0430\u0440\u043f\u0438\u0442) \u0434\u043b\u044f \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0445 SSH-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439 | ProHoster","og:description":"\u041d\u0435 \u0441\u0435\u043a\u0440\u0435\u0442, \u0447\u0442\u043e \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u2014 \u043e\u0447\u0435\u043d\u044c \u0432\u0440\u0430\u0436\u0434\u0435\u0431\u043d\u0430\u044f \u0441\u0440\u0435\u0434\u0430. \u041a\u0430\u043a \u0442\u043e\u043b\u044c\u043a\u043e \u0432\u044b \u043f\u043e\u0434\u043d\u0438\u043c\u0430\u0435\u0442\u0435 \u0441\u0435\u0440\u0432\u0435\u0440, \u043e\u043d \u043c\u0433\u043d\u043e\u0432\u0435\u043d\u043d\u043e \u043f\u043e\u0434\u0432\u0435\u0440\u0433\u0430\u0435\u0442\u0441\u044f \u043c\u0430\u0441\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0430\u0442\u0430\u043a\u0430\u043c \u0438 \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u043c \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f\u043c. \u041d\u0430 \u043f\u0440\u0438\u043c\u0435\u0440\u0435 \u0445\u0430\u043d\u0438\u043f\u043e\u0442\u0430 \u043e\u0442 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0438\u043a\u043e\u0432 \u043c\u043e\u0436\u043d\u043e \u043e\u0446\u0435\u043d\u0438\u0442\u044c \u043c\u0430\u0441\u0448\u0442\u0430\u0431 \u044d\u0442\u043e\u0433\u043e \u043c\u0443\u0441\u043e\u0440\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430. \u0424\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438, \u043d\u0430 \u0441\u0440\u0435\u0434\u043d\u0435\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 99% \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c. Tarpit \u2014 \u044d\u0442\u043e \u043f\u043e\u0440\u0442-\u043b\u043e\u0432\u0443\u0448\u043a\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u0437\u0430\u043c\u0435\u0434\u043b\u0435\u043d\u0438\u044f \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0445 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439. \u0415\u0441\u043b\u0438 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u044f\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f","og:url":"https:\/\/prohoster.info\/sq\/blog\/lovushka-tarpit-dlya-vhodyashhih-ssh-soedinenij","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:34:49+00:00","article:modified_time":"2019-10-31T18:34:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"30312","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 00:38:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:37:27","updated":"2026-01-21 00:38:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/30312","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=30312"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/30312\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=30312"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=30312"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=30312"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}