6 ms·
My favorite is to implement a tarpit while moving the ssh port.
by twodai 5y ago
My favorite is to implement a tarpit while moving the ssh port.
- themulticaster 5y agoDoes that mean that you automatically block IPs that try to login on port 22 (since they are obviously malicious/port scannners)? If yes, is there any specialized daemon for that or are you using firewall rules? Or are you running a SSH honeypot on port 22?
- ben_bai 5y agoA tarpit is a technique to waste your opponents time and network sockets. Usually by accepting the connection but only sending or receiving data at like 1byte/s.
- c0wb0yc0d3r 5y agoThe post is referring to this: https://github.com/skeeto/endlessh https://github.com/skeeto/endlessh I'm guessing that the person you replied to is referring to the same.
- rualca 5y ago> My favorite is to implement a tarpit while moving the ssh port. For those who, like me, are unfamiliar with the concept of a SSH tarpit, it's a technique consisting of inserting delays into SSH connection attempts. Old HN discussion on Endlessh: https://news.ycombinator.com/item?id=24491453 https://news.ycombinator.com/item?id=24491453
- hda111 5y agoIsn’t this easily detectable for any malicious script? Just a small timeout and try the next port.