endlessh

There is a similar thing for ssh servers, called endlessh (https://github.com/skeeto/endlessh). In the ssh protocol the client must wait for the server to send back a banner when it first connects, but there is no limit for the size of it ! So this program will send an infinite banner very ... very slowly; and make the crawler/script kiddie script hang out indefinitely or just crash.

Check this out if you want to stop this behavior... https://github.com/skeeto/endlessh

Nice idea! Btw, such reverse slow-loris “attack” is called a tarpit. SSH tarpit example: https://github.com/skeeto/endlessh

Or a tar pit: https://github.com/skeeto/endlessh

It's a tarpit that slowly sends a message to bots to keep them (and their bandwidth, memory, and CPUs) occupied: https://github.com/skeeto/endlessh?tab=readme-ov-file

Nice idea. From the docs: Endlessh is an SSH tarpit that very slowly sends an endless, random SSH banner. It keeps SSH clients locked up for hours or even days at a time. The purpose is to put your real SSH server on another port and then let the script kiddies get stuck in this tarpit instead of bothering a real server. Since the tarpit is in the banner before any cryptographic exchange occurs, this program doesn't depend on any cryptographic libraries. It's a simple, single-threaded, standalone C program. It uses poll() to trap multiple clients at a time. https://github.com/skeeto/endlessh

if you have people wanting SSH, there's this: https://github.com/skeeto/endlessh

You could try to put them in a tar pit! https://github.com/skeeto/endlessh

May I humbly suggest https://github.com/skeeto/endlessh for both fun and profit

This is not the best solution (fail2ban and 2fa would be better) but https://github.com/skeeto/endlessh is a neat tool if you want to annoy someone with unsophisticated scripts. It’s worth noting that annoying a script kiddie might get you ddosed.

The post is referring to this: https://github.com/skeeto/endlessh I'm guessing that the person you replied to is referring to the same.

A few useful resources: If you don't want your SSH server being found by trivial port-scanning, apply port-knocking: https://github.com/moxie0/knockknock If you want to help secure the interwebs, host this tarpit to try to slow down network scanners: https://github.com/skeeto/endlessh

I've seen endlessh[0] referenced in the past. Here's an article that talks about this and other SSH tarpits[1]. [0]: https://github.com/skeeto/endlessh [1]: https://nullprogram.com/blog/2019/03/22/

Services like that are typically called tarpits, for SSH you can use Endlessh: https://github.com/skeeto/endlessh