The Nightmare of SSH Brute-force Attacks
Every second, thousands of bots are tirelessly “knocking” on port 22 of Linux servers worldwide. If you manage a VPS with a public IP, try checking your security logs. You’ll see shocking numbers: tens of thousands of unauthorized login attempts daily. Through auditing over 10 real-world systems, I’ve noticed bots constantly scanning with common usernames like admin, root, or test.
The most common solution today is using Fail2ban to block IPs. However, Fail2ban simply disconnects the connection. An attacker blocked here will immediately move to another target. So why don’t we try “detaining” them? Instead of chasing them away, let’s lock them in a trap with no exit called Endlessh.
What is Endlessh? The Power of an SSH Tarpit
Think of Endlessh as a digital tarpit. Its operation is incredibly simple yet extremely effective. When a bot connects to the SSH port, instead of asking for a password, Endlessh sends endless, agonizingly slow banner lines.
According to the SSH protocol, the client must wait to receive the full banner from the server before starting authentication. Endlessh exploits this loophole by sending each line of text about 10 seconds apart. The bot on the other end falls into a state of infinite waiting. It cannot proceed to the password entry step, nor does it proactively disconnect, thinking the server is just responding slowly due to network congestion.
A connection can be “trapped” for several days. This forces the attacker to waste resources on meaningless sockets. Consequently, the efficiency of botnet networks is significantly reduced.
Implementation Steps
Before we begin, a vital note: You must change your real SSH port to another number (e.g., 2222) before installing Endlessh on port 22. If you forget this step, you will be the one locked out of your own server.
Step 1: Relocating the real SSH port
First, open the SSH configuration file:
sudo nano /etc/ssh/sshd_configFind the line #Port 22, uncomment it, and change it to the new port:
Port 2222Next, open this port on the firewall and restart the service. Do not exit the current session until you are sure you can log in using the new port.
sudo ufw allow 2222/tcp
sudo systemctl restart sshStep 2: Installing Endlessh
On Ubuntu or Debian, Endlessh is available in the official repositories. Installation takes only a few seconds:
sudo apt update
sudo apt install endlesshIf you use other distributions or want to build from source for optimization, use Git:
git clone https://github.com/skeeto/endlessh
cd endlessh
make
sudo cp endlessh /usr/local/bin/Step 3: Configuring the trap
The configuration file is usually located at /etc/endlessh/config. If it doesn’t exist, create it. Below is a configuration I’ve fine-tuned for high efficiency while remaining lightweight:
# Listen on standard port 22
Port 22
# Send a banner line every 10 seconds (10000ms)
Delay 10000
# Limit line length to save bandwidth
MaxLineLength 32
# Accept a maximum of 4096 simultaneous connections
MaxClients 4096
LogLevel 1Step 4: Granting permissions and running the Service
Normally, only root privileges can use ports below 1024. For safety, we will use setcap to allow Endlessh to run on port 22 without root privileges:
sudo setcap 'cap_net_bind_service=+ep' /usr/bin/endlesshNext, create a service management file with Systemd:
sudo nano /lib/systemd/system/endlessh.servicePaste the following content into the file:
[Unit]
Description=Endlessh SSH Tarpit
After=network.target
[Service]
Type=simple
ExecStart=/usr/bin/endlessh -f /etc/endlessh/config
KillMode=mixed
Restart=always
User=nobody
Group=nogroup
[Install]
WantedBy=multi-user.targetActivate the trap with the command:
sudo systemctl enable endlessh
sudo systemctl start endlesshTesting the effectiveness
To see if the trap is working, try connecting to port 22 from another machine:
ssh -p 22 user@your-server-ip -vYou will see the terminal hang. Thanks to the -v flag, you’ll see random characters trickling in every 10 seconds. To see the list of “victims”, use the log viewing command:
journalctl -u endlessh -fI once recorded a persistent bot staying in the trap for 120,000 seconds (over 33 hours). Watching an attacker waste time instead of damaging the system is very satisfying.
Conclusion
While Endlessh is very interesting, it’s not a “silver bullet”. You still need to maintain core security layers like using SSH Keys, enabling 2FA, and IP Whitelisting. Endlessh acts as a psychological deterrent. It’s extremely effective at clearing out mass scanning attacks, making your server quieter in a high-risk network environment.
