skeeto/endlessh

Health v2 · maintenance only

Adoption not part of the score

8542 stars · 300 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

Endlessh is an SSH tarpit daemon written in C that slowly sends an endless, random SSH pre-authentication banner to keep malicious clients connected for hours or days. It is a single-threaded, dependency-free program meant to occupy attackers while the real SSH server runs on another port.

Use cases

• trap ssh brute-force bots in a tarpit
• protect real ssh server by moving it to another port
• slow down automated ssh scanners
• waste attacker time on a honeypot port
• reduce ssh log noise from script kiddies

When to choose

• you want a lightweight, dependency-free ssh tarpit
• you need to occupy bots while real ssh runs on a nonstandard port
• you prefer a simple single-binary daemon with syslog support

When to avoid

• you need full honeypot interaction like logging credentials (use cowrie)
• you want to block rather than delay attackers (use fail2ban or firewall rules)
• you need a Windows-native solution

Facets

cli-tool · maturity stable

security networking http-server security developer-tools self-hosted bsd cli cross-platform ssh-tarpit honeypot ssh brute-force-protection c linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="skeeto/endlessh")