On: AS13335 doing SSH scanning

[jimsi]

My OpenSSH is located on a non standard port, 22/tcp is going to the endlessh honeypot.

[throw0101a → jimsi]

> endlessh honeypot.

*tarpit

A honeypot lets people "in" to see/research malware that's in the wild:

* https://en.wikipedia.org/wiki/Honeypot_(computing)

A tarpit just takes up the attacker's resources:

* https://en.wikipedia.org/wiki/Tarpit_(networking)

[judge2020 → throw0101a]

Not what most people run, but SSH honeypots are also useful:

https://lwn.net/Articles/848291/

[zinekeller → jimsi]

Not to disappoint you, but except for logging SSH honeypots are becoming useless (most bots automatically disconnect when they detect a long login banner).

[sudobash1 → zinekeller]

So should I add a long banner to my server to disguise it as a honey pot, just in case?

[zinekeller → sudobash1]

I mean, I'm not sure that you can do that with OpenSSH though (short of recompiling it, which I do not recommend unless you're a company).