5 Commits

Author SHA1 Message Date
Christopher Wellons
30e3ff1f32 Example of making the first line special 2019-03-26 10:48:21 -04:00
Christopher Wellons
e7c93c6664 Add link to main article in README 2019-03-25 09:37:34 -04:00
Christopher Wellons
a6d4565a10 Fix -V typo in usage documentation (#11) 2019-03-25 09:26:17 -04:00
Christopher Wellons
09e55cc553 Check for FreeBSD and adjust feature test macros
Fixes #2.
2019-03-25 09:24:44 -04:00
Christopher Wellons
44219a5e05 Add note about RHEL 6 / CentOS 6
Fixes #10.
2019-03-25 09:17:48 -04:00
2 changed files with 51 additions and 7 deletions

View File

@@ -1,9 +1,9 @@
# Endlessh: an SSH tarpit
Endlessh is an SSH tarpit that *very* slowly sends an endless, random
SSH banner. It keeps SSH clients locked up for hours or even days at a
time. The purpose is to put your real SSH server on another port and
then let the script kiddies get stuck in this tarpit instead of
Endlessh is an SSH tarpit [that *very* slowly sends an endless, random
SSH banner][np]. It keeps SSH clients locked up for hours or even days
at a time. The purpose is to put your real SSH server on another port
and then let the script kiddies get stuck in this tarpit instead of
bothering a real server.
Since the tarpit is in the banner before any cryptographic exchange
@@ -11,6 +11,8 @@ occurs, this program doesn't depend on any cryptographic libraries. It's
a simple, single-threaded, standalone C program. It uses `poll()` to
trap multiple clients at a time.
## Usage
Usage information is printed with `-h`.
@@ -68,3 +70,14 @@ MaxClients 4096
# 2 = Very noisy debugging information
LogLevel 0
```
## Build issues
RHEL 6 and CentOS 6 use a version of glibc older than 2.17 (December
2012), and `clock_gettime(2)` is still in librt. For these systems you
will need to link against librt:
make LDLIBS=-lrt
[np]: https://nullprogram.com/blog/2019/03/22/

View File

@@ -1,4 +1,22 @@
#define _POSIX_C_SOURCE 200809L
#ifdef __FreeBSD__
# define _WITH_GETLINE
/* The MSG_DONTWAIT send(2) flag is non-standard, but widely available.
* However, FreeBSD doesn't define this flag when using POSIX feature
* test macros. Normally feature test macros are required to expose
* POSIX functionality, though FreeBSD isn't strict about this. In a
* sense it's technically correct to hide a non-standard flag when
* asking for strict standards compliance, but this behavior makes this
* flag impossible to use in portable programs, at least without this
* sort of special case.
*
* To get the prototype for getline(3), we need either a POSIX feature
* test macro or use the FreeBSD-specific _WITH_GETLINE macro. Since we
* can't use the former, we'll have to go with the latter.
*/
#else
# define _POSIX_C_SOURCE 200809L
#endif
#include <time.h>
#include <errno.h>
#include <stdio.h>
@@ -23,6 +41,9 @@
#define DEFAULT_MAX_CLIENTS 4096
#define DEFAULT_CONFIG_FILE "/etc/endlessh/config"
#define FLAG_SPECIAL_SENT (1 << 0)
#define SPECIAL_MESSAGE "Stay awhile and listen\r\n"
#define XSTR(s) STR(s)
#define STR(s) #s
@@ -73,6 +94,7 @@ struct client {
struct client *next;
int port;
int fd;
int flags;
};
static struct client *
@@ -86,6 +108,7 @@ client_new(int fd, long long send_next)
c->bytes_sent = 0;
c->next = 0;
c->fd = fd;
c->flags = 0;
/* Set the smallest possible recieve buffer. This reduces local
* resource usage and slows down the remote end.
@@ -496,7 +519,7 @@ usage(FILE *f)
fprintf(f, " -p INT Listening port [" XSTR(DEFAULT_PORT) "]\n");
fprintf(f, " -v Print diagnostics to standard output "
"(repeatable)\n");
fprintf(f, " -v Print version information and exit\n");
fprintf(f, " -V Print version information and exit\n");
}
static void
@@ -712,7 +735,15 @@ main(int argc, char **argv)
} else if (revents & POLLOUT) {
char line[256];
int len = randline(line, config.max_line_length, &rng);
int len;
if (!(client->flags & FLAG_SPECIAL_SENT)) {
static const char special[] = SPECIAL_MESSAGE;
len = sizeof(special) - 1;
memcpy(line, special, len);
client->flags |= FLAG_SPECIAL_SENT;
} else {
len = randline(line, config.max_line_length, &rng);
}
for (;;) {
/* Don't really care if send is short */
ssize_t out = send(fd, line, len, MSG_DONTWAIT);