- Home
- Honeypot Software
- Endlessh
Endlessh
What it is
Endlessh is a free, open-source SSH tarpit for Linux and self-hosted use. It slowly sends random SSH banner text so unwanted SSH clients remain occupied rather than quickly moving on. The project describes placing a real SSH server on a different port, leaving Endlessh to hold clients that connect to the tarpit. It is a standalone, single-threaded C program that uses poll() to handle multiple clients. Since the banner is sent before cryptographic exchange, the program does not rely on cryptographic libraries. Defaults include a 10,000-millisecond delay between messages, a 32-character maximum banner line, and a 4,096-client limit; additional connections wait in a queue. It supports IPv4 and IPv6, with options to bind to either address family alone. Diagnostics are quiet by default, with verbosity flags and syslog logging available. The configuration syntax is similar to OpenSSH and defaults to /etc/endlessh/config. Signals can shut down the daemon gracefully, reload configuration, or log connection statistics. The repository identifies the license as the Unlicense and provides GitHub Issues and Pull Requests for discussion and contributions.
For and against
For
- Free and open source under the Unlicense
- Handles multiple clients using poll()
- Supports both IPv4 and IPv6
- Includes syslog logging and verbosity options
- Default limit allows up to 4,096 clients
Against
- Linux and self-hosted platforms only
- Additional connections wait in the queue
- Does not list third-party service integrations
The verdict
Endlessh is a focused, self-hosted tool for keeping unwanted SSH clients occupied, with configurable networking and logging. It requires a Linux deployment and a separate port for the real SSH server.
Who it suits
Endlessh may suit administrators who want a self-hosted SSH tarpit on Linux. It is intended to occupy unwanted SSH clients while a real SSH server runs on another port.
Plans and prices
Endlessh
SSH tarpit · standalone C program · maximum 4096 clients by default
Read 4 Oct 2026 · github.com
On the record
- Banner controls
- The delay between messages defaults to 10000 milliseconds, and the maximum banner line length defaults to 32 characters.github.com · read 4 Oct 2026
- Build platforms
- The project documents build adjustments for RHEL 6/CentOS 6, Solaris/illumos, and OpenBSD.github.com · read 4 Oct 2026
- Configuration
- The configuration file uses syntax similar to OpenSSH and defaults to /etc/endlessh/config.github.com · read 4 Oct 2026
- Connection limit
- The maximum number of clients defaults to 4096, and excess connections wait in the queue.github.com · read 4 Oct 2026
- Cryptography
- The banner is sent before any cryptographic exchange, so the program does not depend on cryptographic libraries.github.com · read 4 Oct 2026
- Implementation
- Endlessh is a standalone, single-threaded C program that uses poll() to handle multiple clients.github.com · read 4 Oct 2026
- Integrations
- The README describes logging to standard output or syslog and does not list third-party service integrations.github.com · read 4 Oct 2026
- License
- The repository identifies its license as the Unlicense.github.com · read 4 Oct 2026
- Logging
- Diagnostics are quiet by default; repeatable verbosity flags enable standard and debug logging, and logs can be sent to syslog.github.com · read 4 Oct 2026
- Network support
- Endlessh supports IPv4 and IPv6, with options to bind to either address family alone.github.com · read 4 Oct 2026
- Purpose
- Endlessh slowly sends an endless, random SSH banner to keep SSH clients occupied for hours or days.github.com · read 4 Oct 2026
- Signals
- SIGTERM gracefully shuts down the daemon, SIGHUP reloads its configuration, and SIGUSR1 prints connection statistics to the log.github.com · read 4 Oct 2026
- Support
- The repository provides GitHub Issues and Pull Requests for project discussion and contributions.github.com · read 4 Oct 2026
- Use case
- The project describes placing a real SSH server on another port so unwanted SSH clients get stuck in the tarpit instead.github.com · read 4 Oct 2026
