skeeto/endlessh
Endlessh
Endlessh is an SSH tarpit and network honeypot designed to mitigate automated SSH brute force attacks. It acts as a defensive layer that protects servers by diverting malicious connection attempts into a slow-motion trap.
The project implements a tarpit by sending endless, throttled banners to clients, which keeps connections open indefinitely to occupy attacker resources and slow down network scans.
The service includes connection rate limiting to prevent system resource exhaustion and provides monitoring through connection activity and diagnostic data logging to system logs. Process management is handled via system signals for configuration reloads and statistics reporting.
Features
- SSH Brute Force Mitigation - Protects servers from automated SSH brute force attempts by diverting traffic into a slow connection trap.
- Automated Attack Diversion - Sends endless slow banners to clients to occupy connections and distract attackers from real servers.
- SSH Connection Tarpitting - Sends slow random banners to clients to keep connections open and divert automated attacks.
- Service Abuse Protections - Protects server resources by managing concurrent connection limits to prevent service exhaustion.
- SSH Attack Mitigators - Provides a defensive layer that diverts malicious SSH connection attempts into a slow-motion trap.
- SSH Attack Diversion - Sends slow motion banners to clients to occupy connections and prevent access to real servers.
- SSH Tarpits - Implements a security tool that slows down SSH connections by sending an endless banner.
- Tarpit Data Emission - Transmits throttled banners to occupy attacker resources and slow down network scans.
- Network Security Monitoring - Logs connection attempts and activity patterns to analyze the source of automated SSH attacks.
- Connection Rate Limiting - Implements limits on concurrent sockets to prevent system resource exhaustion during attacks.
- Blocking Connection Flows - Manages client connections through a blocking flow to maintain the tarpit state.
- Concurrency Limiters - Caps the maximum number of concurrent clients to protect system resources from exhaustion.
- Honeypots and Tarpits - SSH tarpit that slows down scanners by sending an infinite banner.
- SSH Honeypots - SSH tarpit that slows down connection attempts.
