mirror of
https://github.com/skeeto/endlessh.git
synced 2025-12-10 06:55:36 +00:00
Compare commits
5 Commits
0.1
...
special-me
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
30e3ff1f32 | ||
|
|
e7c93c6664 | ||
|
|
a6d4565a10 | ||
|
|
09e55cc553 | ||
|
|
44219a5e05 |
21
README.md
21
README.md
@@ -1,9 +1,9 @@
|
||||
# Endlessh: an SSH tarpit
|
||||
|
||||
Endlessh is an SSH tarpit that *very* slowly sends an endless, random
|
||||
SSH banner. It keeps SSH clients locked up for hours or even days at a
|
||||
time. The purpose is to put your real SSH server on another port and
|
||||
then let the script kiddies get stuck in this tarpit instead of
|
||||
Endlessh is an SSH tarpit [that *very* slowly sends an endless, random
|
||||
SSH banner][np]. It keeps SSH clients locked up for hours or even days
|
||||
at a time. The purpose is to put your real SSH server on another port
|
||||
and then let the script kiddies get stuck in this tarpit instead of
|
||||
bothering a real server.
|
||||
|
||||
Since the tarpit is in the banner before any cryptographic exchange
|
||||
@@ -11,6 +11,8 @@ occurs, this program doesn't depend on any cryptographic libraries. It's
|
||||
a simple, single-threaded, standalone C program. It uses `poll()` to
|
||||
trap multiple clients at a time.
|
||||
|
||||
|
||||
|
||||
## Usage
|
||||
|
||||
Usage information is printed with `-h`.
|
||||
@@ -68,3 +70,14 @@ MaxClients 4096
|
||||
# 2 = Very noisy debugging information
|
||||
LogLevel 0
|
||||
```
|
||||
|
||||
## Build issues
|
||||
|
||||
RHEL 6 and CentOS 6 use a version of glibc older than 2.17 (December
|
||||
2012), and `clock_gettime(2)` is still in librt. For these systems you
|
||||
will need to link against librt:
|
||||
|
||||
make LDLIBS=-lrt
|
||||
|
||||
|
||||
[np]: https://nullprogram.com/blog/2019/03/22/
|
||||
|
||||
37
endlessh.c
37
endlessh.c
@@ -1,4 +1,22 @@
|
||||
#define _POSIX_C_SOURCE 200809L
|
||||
#ifdef __FreeBSD__
|
||||
# define _WITH_GETLINE
|
||||
/* The MSG_DONTWAIT send(2) flag is non-standard, but widely available.
|
||||
* However, FreeBSD doesn't define this flag when using POSIX feature
|
||||
* test macros. Normally feature test macros are required to expose
|
||||
* POSIX functionality, though FreeBSD isn't strict about this. In a
|
||||
* sense it's technically correct to hide a non-standard flag when
|
||||
* asking for strict standards compliance, but this behavior makes this
|
||||
* flag impossible to use in portable programs, at least without this
|
||||
* sort of special case.
|
||||
*
|
||||
* To get the prototype for getline(3), we need either a POSIX feature
|
||||
* test macro or use the FreeBSD-specific _WITH_GETLINE macro. Since we
|
||||
* can't use the former, we'll have to go with the latter.
|
||||
*/
|
||||
#else
|
||||
# define _POSIX_C_SOURCE 200809L
|
||||
#endif
|
||||
|
||||
#include <time.h>
|
||||
#include <errno.h>
|
||||
#include <stdio.h>
|
||||
@@ -23,6 +41,9 @@
|
||||
#define DEFAULT_MAX_CLIENTS 4096
|
||||
#define DEFAULT_CONFIG_FILE "/etc/endlessh/config"
|
||||
|
||||
#define FLAG_SPECIAL_SENT (1 << 0)
|
||||
#define SPECIAL_MESSAGE "Stay awhile and listen\r\n"
|
||||
|
||||
#define XSTR(s) STR(s)
|
||||
#define STR(s) #s
|
||||
|
||||
@@ -73,6 +94,7 @@ struct client {
|
||||
struct client *next;
|
||||
int port;
|
||||
int fd;
|
||||
int flags;
|
||||
};
|
||||
|
||||
static struct client *
|
||||
@@ -86,6 +108,7 @@ client_new(int fd, long long send_next)
|
||||
c->bytes_sent = 0;
|
||||
c->next = 0;
|
||||
c->fd = fd;
|
||||
c->flags = 0;
|
||||
|
||||
/* Set the smallest possible recieve buffer. This reduces local
|
||||
* resource usage and slows down the remote end.
|
||||
@@ -496,7 +519,7 @@ usage(FILE *f)
|
||||
fprintf(f, " -p INT Listening port [" XSTR(DEFAULT_PORT) "]\n");
|
||||
fprintf(f, " -v Print diagnostics to standard output "
|
||||
"(repeatable)\n");
|
||||
fprintf(f, " -v Print version information and exit\n");
|
||||
fprintf(f, " -V Print version information and exit\n");
|
||||
}
|
||||
|
||||
static void
|
||||
@@ -712,7 +735,15 @@ main(int argc, char **argv)
|
||||
|
||||
} else if (revents & POLLOUT) {
|
||||
char line[256];
|
||||
int len = randline(line, config.max_line_length, &rng);
|
||||
int len;
|
||||
if (!(client->flags & FLAG_SPECIAL_SENT)) {
|
||||
static const char special[] = SPECIAL_MESSAGE;
|
||||
len = sizeof(special) - 1;
|
||||
memcpy(line, special, len);
|
||||
client->flags |= FLAG_SPECIAL_SENT;
|
||||
} else {
|
||||
len = randline(line, config.max_line_length, &rng);
|
||||
}
|
||||
for (;;) {
|
||||
/* Don't really care if send is short */
|
||||
ssize_t out = send(fd, line, len, MSG_DONTWAIT);
|
||||
|
||||
Reference in New Issue
Block a user