How to Create an SSH Tarpit
Why Have an SSH Tarpit?
If you have any servers that you access using SSH (Secure Socket Shell) connection, you’ll be familiar with how it can be used my hackers to gain access to your servers. However, you’ll also notice through reviewing your server authentication logs look like something like below:
You’ll notice that bots have been trying to log into your server with some default credentials thousands of times, this method is essentially called the “Brute-force” technique. Now, if you have setup your server an insecure password with password authentication enabled and are using the default port for SSH, you’re highly likely to have a compromised server in your hands. If you have followed some standard best practices for setting up your Linux servers, these attacks might seem harmless.
In this post, we will be protecting our servers with a twist. We will be giving the hackers a taste of their own medicine. 😉
To perform our trick, we are going to leverage the “banner” that is displayed and the fact that there is no real limit to how long it can be or how much time it can take to display its contents. Also, we know that the default port for SSH is usually 22 for any server. Now, we are going to use this concept to force the hacker to read a very long banner that essentially never ends, creating what we call an endlessh (endless SSH) or an SSH tarpit. Through this method, you’re not only protecting your server but you’ll also be wasting the precious time of the hackers, which otherwise could have been used compromising other servers.
How to Create an SSH Tarpit?
We are going to use a git repository for this by skeeto called
endlessh . Log into your server and clone the repository
git clone https://github.com/skeeto/endlessh.git
Now, change to the directory and compile the directory
If you’re using Debain based OS, you might get an error while you’re compiling the program. You’ll the
libc6-dev library to be installed, which you can do using the
apt package manager
sudo apt-get install libc6-dev
We will then move the binary into a folder for your
sudo mv endlessh /usr/local/bin/
Now, lets just verify
# it should print the path like /usr/local/bin/endlessh
Now, we will need to demonize it for which we will copy the
systemd service file
sudo cp util/endlessh.service /etc/systemd/system/
Now, we will enable the
sudo systemctl enable endlessh
Now the last thing we will do is create the configuration file by first creating the folder and then the configuration file inside it, which we will open in an editing mode
mkdir -p /etc/endlessh
sudo nano /etc/endlessh/config
The content of the config file will be the following:
PORT 22 # this is becasue endlessh runs by default on port 2222
Now, we are done with the setup, let’s start the service
sudo systemctl start endlessh
Also, let’s verify that it is actually running
netstat -tulpn | grep enlessh
Once you verify that is the service is running, you’re done. Pretty simple ain’t it?
Mock a Hacker
We will now mock a hacker on another terminal window trying to SSH into the server
ssh root@<server-address> -p 22
Now, you will end up seeing nothing. To actually know what is happening under the hood, we will SSH using the verbose option
ssh -vvv root@<server-address> -p
You’ll notice that the user will keep getting gibberish in the banner, each line taking almost 30 seconds to show up. And since the banner is not generally treated as anything that you can perform a timeout on explicitly the script that the hacker will be using will be stuck on this stage forever, who otherwise would. Mission accomplished 👍 .
You have successfully wasted the time and efforts of a hacker. You are badass. 😎
Now go out there and waste someone’s time and effort and make the world a safer place, one server at a time.
Read more at Grizzlybit 🐻.