Development · GitHub repo
endlessh-go
SSH tarpit written in Go with built-in Prometheus metrics and Grafana support
endlessh-go is a Go implementation of the Endlessh SSH tarpit designed to slow down automated vulnerability scanners and brute-force bots. By slowly trickling out an endless SSH banner, it traps connections for hours on your exposed SSH port while consuming minimal system memory. Unlike the original C version, it natively exports Prometheus metrics and includes a ready-to-use Grafana dashboard with GeoIP visualization.
What it's for
- Trap and stall automated SSH brute-force bots on standard port 22
- Monitor attacking IP addresses and geolocations via Grafana
- Reduce server authentication logs caused by persistent scanners
Features
- Slowly transmits random SSH banner lines to keep client connections hanging
- Prometheus metrics endpoint exporting trapped time, open connections, and bytes sent
- Pre-built Grafana dashboard (ID 15156) with clickable IP links and geolocation maps
- IP geolocation lookups via ip-api or offline MaxMind databases
- HTTP health check endpoint for monitoring container or service uptime
- Support for PROXY protocol headers and multi-port listening
- Official Docker container image for quick deployment
Pricing
Open source
Details
- Type
- GitHub repo
- Category
- Development
- Topic
- Server Security
- Open source
- Yes
- Platforms
- Linux, Self-hosted, Command line
- For
- System administrators, DevOps engineers, and self-hosters looking to deflect SSH scans
- Alternative to
- endlessh, Fail2ban, CrowdSec
- Tags
- ssh, honeypot, security, prometheus, grafana, docker, golang
Why it was saved
- @brusnicadev: Wastes bot resources for hours by pretending to be a slow server on default SSH port 22 while your real SSH daemon runs on a custom port.
Related
Terminal commands to count and monitor failed SSH logins on Linux
Open-source collaborative security engine and intrusion prevention system using crowdsourced threat data.
Log-monitoring daemon that dynamically blocks IP addresses causing repeated authentication failures.
Quick commands to detect and block SSH brute-force attacks on Linux
A three-step checklist to isolate and harden runtimes for arbitrary code execution.
Step-by-step tutorial for deploying Next.js to Hetzner using Kamal
Updated