mirror of
https://github.com/skeeto/endlessh.git
synced 2025-12-11 00:33:02 +00:00
Compare commits
5 Commits
0.1
...
special-me
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
30e3ff1f32 | ||
|
|
e7c93c6664 | ||
|
|
a6d4565a10 | ||
|
|
09e55cc553 | ||
|
|
44219a5e05 |
21
README.md
21
README.md
@@ -1,9 +1,9 @@
|
|||||||
# Endlessh: an SSH tarpit
|
# Endlessh: an SSH tarpit
|
||||||
|
|
||||||
Endlessh is an SSH tarpit that *very* slowly sends an endless, random
|
Endlessh is an SSH tarpit [that *very* slowly sends an endless, random
|
||||||
SSH banner. It keeps SSH clients locked up for hours or even days at a
|
SSH banner][np]. It keeps SSH clients locked up for hours or even days
|
||||||
time. The purpose is to put your real SSH server on another port and
|
at a time. The purpose is to put your real SSH server on another port
|
||||||
then let the script kiddies get stuck in this tarpit instead of
|
and then let the script kiddies get stuck in this tarpit instead of
|
||||||
bothering a real server.
|
bothering a real server.
|
||||||
|
|
||||||
Since the tarpit is in the banner before any cryptographic exchange
|
Since the tarpit is in the banner before any cryptographic exchange
|
||||||
@@ -11,6 +11,8 @@ occurs, this program doesn't depend on any cryptographic libraries. It's
|
|||||||
a simple, single-threaded, standalone C program. It uses `poll()` to
|
a simple, single-threaded, standalone C program. It uses `poll()` to
|
||||||
trap multiple clients at a time.
|
trap multiple clients at a time.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
## Usage
|
## Usage
|
||||||
|
|
||||||
Usage information is printed with `-h`.
|
Usage information is printed with `-h`.
|
||||||
@@ -68,3 +70,14 @@ MaxClients 4096
|
|||||||
# 2 = Very noisy debugging information
|
# 2 = Very noisy debugging information
|
||||||
LogLevel 0
|
LogLevel 0
|
||||||
```
|
```
|
||||||
|
|
||||||
|
## Build issues
|
||||||
|
|
||||||
|
RHEL 6 and CentOS 6 use a version of glibc older than 2.17 (December
|
||||||
|
2012), and `clock_gettime(2)` is still in librt. For these systems you
|
||||||
|
will need to link against librt:
|
||||||
|
|
||||||
|
make LDLIBS=-lrt
|
||||||
|
|
||||||
|
|
||||||
|
[np]: https://nullprogram.com/blog/2019/03/22/
|
||||||
|
|||||||
37
endlessh.c
37
endlessh.c
@@ -1,4 +1,22 @@
|
|||||||
#define _POSIX_C_SOURCE 200809L
|
#ifdef __FreeBSD__
|
||||||
|
# define _WITH_GETLINE
|
||||||
|
/* The MSG_DONTWAIT send(2) flag is non-standard, but widely available.
|
||||||
|
* However, FreeBSD doesn't define this flag when using POSIX feature
|
||||||
|
* test macros. Normally feature test macros are required to expose
|
||||||
|
* POSIX functionality, though FreeBSD isn't strict about this. In a
|
||||||
|
* sense it's technically correct to hide a non-standard flag when
|
||||||
|
* asking for strict standards compliance, but this behavior makes this
|
||||||
|
* flag impossible to use in portable programs, at least without this
|
||||||
|
* sort of special case.
|
||||||
|
*
|
||||||
|
* To get the prototype for getline(3), we need either a POSIX feature
|
||||||
|
* test macro or use the FreeBSD-specific _WITH_GETLINE macro. Since we
|
||||||
|
* can't use the former, we'll have to go with the latter.
|
||||||
|
*/
|
||||||
|
#else
|
||||||
|
# define _POSIX_C_SOURCE 200809L
|
||||||
|
#endif
|
||||||
|
|
||||||
#include <time.h>
|
#include <time.h>
|
||||||
#include <errno.h>
|
#include <errno.h>
|
||||||
#include <stdio.h>
|
#include <stdio.h>
|
||||||
@@ -23,6 +41,9 @@
|
|||||||
#define DEFAULT_MAX_CLIENTS 4096
|
#define DEFAULT_MAX_CLIENTS 4096
|
||||||
#define DEFAULT_CONFIG_FILE "/etc/endlessh/config"
|
#define DEFAULT_CONFIG_FILE "/etc/endlessh/config"
|
||||||
|
|
||||||
|
#define FLAG_SPECIAL_SENT (1 << 0)
|
||||||
|
#define SPECIAL_MESSAGE "Stay awhile and listen\r\n"
|
||||||
|
|
||||||
#define XSTR(s) STR(s)
|
#define XSTR(s) STR(s)
|
||||||
#define STR(s) #s
|
#define STR(s) #s
|
||||||
|
|
||||||
@@ -73,6 +94,7 @@ struct client {
|
|||||||
struct client *next;
|
struct client *next;
|
||||||
int port;
|
int port;
|
||||||
int fd;
|
int fd;
|
||||||
|
int flags;
|
||||||
};
|
};
|
||||||
|
|
||||||
static struct client *
|
static struct client *
|
||||||
@@ -86,6 +108,7 @@ client_new(int fd, long long send_next)
|
|||||||
c->bytes_sent = 0;
|
c->bytes_sent = 0;
|
||||||
c->next = 0;
|
c->next = 0;
|
||||||
c->fd = fd;
|
c->fd = fd;
|
||||||
|
c->flags = 0;
|
||||||
|
|
||||||
/* Set the smallest possible recieve buffer. This reduces local
|
/* Set the smallest possible recieve buffer. This reduces local
|
||||||
* resource usage and slows down the remote end.
|
* resource usage and slows down the remote end.
|
||||||
@@ -496,7 +519,7 @@ usage(FILE *f)
|
|||||||
fprintf(f, " -p INT Listening port [" XSTR(DEFAULT_PORT) "]\n");
|
fprintf(f, " -p INT Listening port [" XSTR(DEFAULT_PORT) "]\n");
|
||||||
fprintf(f, " -v Print diagnostics to standard output "
|
fprintf(f, " -v Print diagnostics to standard output "
|
||||||
"(repeatable)\n");
|
"(repeatable)\n");
|
||||||
fprintf(f, " -v Print version information and exit\n");
|
fprintf(f, " -V Print version information and exit\n");
|
||||||
}
|
}
|
||||||
|
|
||||||
static void
|
static void
|
||||||
@@ -712,7 +735,15 @@ main(int argc, char **argv)
|
|||||||
|
|
||||||
} else if (revents & POLLOUT) {
|
} else if (revents & POLLOUT) {
|
||||||
char line[256];
|
char line[256];
|
||||||
int len = randline(line, config.max_line_length, &rng);
|
int len;
|
||||||
|
if (!(client->flags & FLAG_SPECIAL_SENT)) {
|
||||||
|
static const char special[] = SPECIAL_MESSAGE;
|
||||||
|
len = sizeof(special) - 1;
|
||||||
|
memcpy(line, special, len);
|
||||||
|
client->flags |= FLAG_SPECIAL_SENT;
|
||||||
|
} else {
|
||||||
|
len = randline(line, config.max_line_length, &rng);
|
||||||
|
}
|
||||||
for (;;) {
|
for (;;) {
|
||||||
/* Don't really care if send is short */
|
/* Don't really care if send is short */
|
||||||
ssize_t out = send(fd, line, len, MSG_DONTWAIT);
|
ssize_t out = send(fd, line, len, MSG_DONTWAIT);
|
||||||
|
|||||||
Reference in New Issue
Block a user