Dan Q
This checkin to GC8KR7D Motorway Mayhem (another one) reflects a geocaching.com log entry. See more of Dan's cache logs.
The geohound and I braved an explore of this litter-filled GZ but couldn’t spot a cache among the copious detritus before the whiny little thing started fighting to get back to the warm of the car and to the rest of her “pack”. Maybe next time we pass by this way.
I had a smug moment when I saw security researcher Rob Ricci and friends’ paper empirically analysing brute-force attacks against SSH “in the wild”.1 It turns out that putting all your SSH servers on “weird” port numbers – which I’ve routinely done for over a decade – remains a pretty-effective way to stop all that unwanted traffic2, whether or not you decide to enhance that with some fail2ban magic.
But then I saw a comment about Endlessh. Endlessh3 acts like an SSH server but then basically reverse-Slow-Loris’s the connecting client, very gradually feeding it an infinitely-long SSH banner and hanging it for… well, maybe 15 seconds or so but possibly up to a week.
I was just setting up a new Debian 12 server when I learned about this. I’d already moved the SSH server port away from the default 224, so I figured I’d launch Endlessh on port 22 to slow down and annoy scanners.
Installation wasn’t as easy as I’d hoped considering there’s a package. Here’s what I needed to do:
sudo apt update && sudo apt install -y endlessh
sudo setcap 'cap_net_bind_service=+ep' /usr/bin/endlessh
/etc/systemd/system/multi-user.target.wants/endlessh.service in the following ways:
AmbientCapabilities=CAP_NET_BIND_SERVICE
PrivateUsers=true
InaccessiblePaths=/run /var into InaccessiblePaths=/var
sudo systemctl daemon-reload
echo "Port 22" | sudo tee /etc/endlessh/config
sudo service endlessh start
To test if it’s working, connect to your SSH server on port 22 with your client in verbose mode, e.g. ssh -vp22 example.com and look for banner lines full of random garbage
appearing at 10 second intervals.
It doesn’t provide a significant security, but you get to enjoy the self-satisfied feeling that you’re trolling dozens of opportunistic script kiddies a day.
1 It’s a good paper in general, if that’s your jam.
2 Obviously you gain very little security by moving to an unusual port number, given that
you’re already running your servers in “keys-only” (PasswordAuthentication no) configuration mode already, right? Right!? But it’s nice to avoid all the unnecessary
logging that wave after wave of brute-force attempts produce.
3 Which I can only assume is pronounced endle-S-S-H, but regardless of how it’s said out loud I appreciate the wordplay of its name.
4 To move your SSH port, you might run something like echo "Port 12345" | sudo tee
/etc/ssh/sshd_config.d/unusual-port.conf and restart the service, of course.