TL;DR — Quick Summary

Deploy Endlessh to trap SSH brute-force attackers in an endless SSH banner. Wastes attacker resources while protecting your real SSH server. Lightweight Docker deployment.

Endlessh — SSH Tarpit

services:
  endlessh:
    image: shizunge/endlessh-go:latest
    container_name: endlessh
    restart: always
    ports:
      - "22:2222"
    environment:
      - LEN=32
      - DELAY=10000
      - MAX_CLIENTS=4096

How It Works

  1. Attacker connects to port 22
  2. Endlessh sends one random line every 10 seconds
  3. SSH protocol waits for the banner to finish
  4. Attacker is trapped for hours/days
  5. Your real SSH is on port 2222, unreachable to scanners