Stop SSH bruteforce with endlessh

Endlessh is an open source SSH trapit. It send slow random banner string to attacker, wasting their time.

Before you install endlessh, you need to change your SSH port to a higher non default port. To do this edit

vi /etc/ssh/sshd_config

Find

Port 22

Replace with

Port YOUR_NEW_PORT_HERE

If the line is commented with #, uncomment it.

Now you can install endlessh with

cd /usr/local/src
git clone https://github.com/skeeto/endlessh
cd /usr/local/src/endlessh
make
cp endlessh /usr/local/bin
cp /usr/local/src/endlessh/util/endlessh.service /etc/systemd/system/

By default endlessh run on port 2222. To change it to port 22, edit file

vi /etc/systemd/system/endlessh.service

Find

#AmbientCapabilities=CAP_NET_BIND_SERVICE

Replace with

AmbientCapabilities=CAP_NET_BIND_SERVICE

Find

PrivateUsers=true

Replace with

#PrivateUsers=true

Run

setcap 'cap_net_bind_service=+ep' /usr/local/bin/endlessh

Create endlessh configuration file

vi /etc/endlessh/config

Add following content

Port 22
Delay 10000
MaxLineLength 32
MaxClients 4096
LogLevel 0
BindFamily 0

If you need to enable log, set LogLevel to 1.

Enable and restart endlessh

systemctl enable endlessh
systemctl start endlessh