ENDLESSH(1)

NAME
endlessh - SSH tarpit

SYNOPSIS
endlessh [-46chsvV] [-d delay] [-f config] [-l max banner length] [-m max clients] [-p port]

DESCRIPTION
endlessh is an SSH tarpit that very slowly sends an endless, random SSH banner.

endlessh keeps SSH clients locked up for hours or even days at a time. The purpose is to put your real SSH server on another port and then let the script kiddies get stuck in this tarpit instead of bothering a real server.

Since the tarpit is in the banner before any cryptographic exchange occurs, this program doesn't depend on any cryptographic libraries. It's a simple, single-threaded, standalone C program. It uses poll() to trap multiple clients at a time.

The options are as follows:

-4  Forces endlessh to use IPv4 addresses only.

-6  Forces endlessh to use IPv6 addresses only.

-d delay
    Message milliseconds delay. Default: 10000

-f config
    Set and load config file. By default endlessh looks for /etc/endlessh/config.

-h  Print the help message and exit.

-l max banner length
    Maximum banner line length (3-255). Default: 32

-m max clients
    Maximum number of clients. Default: 4096

-p port
    Set the listening port. By default endlessh listens on port 2222.

-s  Print diagnostics to syslog. By default endlessh prints them to standard output.

-v  Print diagnostics. Can be specified up to twice to increase verbosity.

-V  Causes endlessh to print version information and exit.

If endlessh receives the SIGTERM signal it will gracefully shut down the daemon, allowing it to write a complete, consistent log.

A SIGHUP signal requests a reload of its configuration file.

A SIGUSR1 signal will print connections stats to the log.

FILES
/etc/endlessh/config
    The default endlessh configuration file.