endlessh for Mac

Endlessh: an SSH tarpit

Endlessh is an SSH tarpit that very slowly sends an endless, random SSH banner. It keeps SSH clients locked up for hours or even days at a time. The purpose is to put your real SSH server on another port and then let the script kiddies get stuck in this tarpit instead of bothering a real server.

Since the tarpit is in the banner before any cryptographic exchange occurs, this program doesn't depend on any cryptographic libraries. It's a simple, single-threaded, standalone C program. It uses poll() to trap multiple clients at a time.

Usage

Usage information is printed with -h.

Argument order matters. The configuration file is loaded when the -f argument is processed, so only the options that follow will override the configuration file.

By default no log messages are produced. The first -v enables basic logging and a second -v enables debugging logging (noisy). All log messages are sent to standard output by default. -s causes them to be sent to syslog.

endlessh -v >endlessh.log 2>endlessh.err

A SIGTERM signal will gracefully shut down the daemon, allowing it to write a complete, consistent log.

A SIGHUP signal requests a reload of the configuration file (-f).

A SIGUSR1 signal will print connections stats to the log.

Sample Configuration File

The configuration file has similar syntax to OpenSSH.

Build issues

Some more esoteric systems require extra configuration when building.

RHEL 6 / CentOS 6

This system uses a version of glibc older than 2.17 (December 2012), and clock_gettime(2) is still in librt. For these systems you will need to link against librt:

make LDLIBS=-lrt

Solaris / illumos

These systems don't include all the necessary functionality in libc and the linker requires some extra libraries:

make CC=gcc LDLIBS='-lnsl -lrt -lsocket'

If you're not using GCC or Clang, also override CFLAGS and LDFLAGS to remove GCC-specific options. For example, on Solaris:

make CFLAGS=-fast LDFLAGS= LDLIBS='-lnsl -lrt -lsocket'

The feature test macros on these systems isn't reliable, so you may also need to use -D__EXTENSIONS__ in CFLAGS.

OpenBSD

The man page needs to go into a different path for OpenBSD's man command: