Hacker News Reader

Comment by ams6110 | Hacker News Reader

I'm not sure I like this. How secure is it? Anything you put on port 22 is going to be attacked relentlessly. I think I'd rather have OpenSSH handling those attacks than some tarpit program that may or may not have been subjected to the audits and the trial-by-fire that OpenSSH has.

View on HN

It's as safe as it can get. None of the versions he showed in the post actually read any data from the attacker. It only accepts the connection, then writes random data to it every 10 seconds forever.

I'm not sure I catch your drift. It seems like the point is that it doesn't actually implement the SSH protocol- it just exploits the fact that a real SSH server is perfectly within its rights to send any data it wants to before a version string. (And on top of that, it looks like it doesn't even read anything from the socket?)

Is there something I'm missing here (probably related to poll(2)) that could cause this to be insecure?

A program like this has vastly less attack surface than a full SSH protocol implementation. In particular, it doesn't support the part of the SSH protocol that allows executing commands on a remote host. So the only way this will be less secure than OpenSSH is if there's some memory unsafety or a leak of some kind.

almost all of the SSH protocol isn't exposed until you authenticate, and in the vast majority of setups that means you get a shell to execute commands with anyways, so while still important, the key problems are with pre-auth security.

Sure, but "isn't exposed" is very different from "that functionality is physically not present in this executable."

Any tarpit has the potential to piss someone off. I'd run it on a sacrificial server with no obvious way to tie back to who is running it.

You can always tie it to the organization who is running it, by the simple fact of looking at the IP address that is "acting slow".

Years ago when I was playing network admin for a company, I set up a tarpit system which ran for a few years. In that time we never encountered one pissed off person in person (or on the Internet).

Why worry about pissing off the kind of person who scans for open SSH ports for no apparent legitimate reason? Are you concerned that the Chinese are going to try even harder to hack your machine, like they're not already doing everything they can to break in?

The vast majority are going for the low hanging fruit. I don't have to outrun the bear. I just have to outrun you.

They may be the same type of person that would launch a ddos, for example.

I'm not concerned about this, personally.

On my home server, there are only two ports open to the internet -- one for my SSH server, and one for my VPN server. Both of those are running on nonstandard ports.

In order to DDOS me, an attacker has to find those ports, which would require a comprehensive scan (increasing the chances that they'll get blocked by my ISP or detected by my antiscan monitor) or a huge amount of luck. And even then, they'll just be able to DDOS my SSH server and VPN. That wouldn't be awesome, but wouldn't exactly be disastrous.

You can change your ports but it won't prevent "Eve" from scanning for those as you mention yourself. I think this belongs to the realm of "security through obscurity" tactics and won't be safe in the long run.

I can prevent being blocked by your ISP by adjusting the timings etc. of my scripts.

I think it's far more important to take a look at the supported key exchange algorithms etc.

You are correct. This falls into the cost/benefit calculation of security. A DDOS attack on my home network would be annoying, but not devastating, so I'm willing to accept a little vulnerability to them in exchange for other benefits.

> I can prevent being blocked by your ISP by adjusting the timings etc. of my scripts.

But that won't let you escape detection by my system's own defenses. Well, you could if you slowed down the scan enough -- but "enough" is pretty darned slow.

If your IP doesn't change that often or is static, I'm curious how much Shodan knows about your open ports?

> How secure is it?

Since it doesn't actually have the ability to do anything, it's pretty darned secure.

The source code in the article shows that your concerns aren't really.. concerns.

Reply on news.ycombinator.com