# endlessh-go

> SSH tarpit written in Go with built-in Prometheus metrics and Grafana support

endlessh-go is a Go implementation of the Endlessh SSH tarpit designed to slow down automated vulnerability scanners and brute-force bots. By slowly trickling out an endless SSH banner, it traps connections for hours on your exposed SSH port while consuming minimal system memory. Unlike the original C version, it natively exports Prometheus metrics and includes a ready-to-use Grafana dashboard with GeoIP visualization.

Website: https://github.com/shizunge/endlessh-go

## What it is for

- Trap and stall automated SSH brute-force bots on standard port 22
- Monitor attacking IP addresses and geolocations via Grafana
- Reduce server authentication logs caused by persistent scanners

## Features

- Slowly transmits random SSH banner lines to keep client connections hanging
- Prometheus metrics endpoint exporting trapped time, open connections, and bytes sent
- Pre-built Grafana dashboard (ID 15156) with clickable IP links and geolocation maps
- IP geolocation lookups via ip-api or offline MaxMind databases
- HTTP health check endpoint for monitoring container or service uptime
- Support for PROXY protocol headers and multi-port listening
- Official Docker container image for quick deployment

## Pricing

Open source

## Details

- Type: GitHub repo
- Category: [Development](https://xiry.app/topics/development.md)
- Topic: [Server Security](https://xiry.app/topics/development/server-security.md)
- Open source: yes
- Platforms: Linux, Self-hosted, Command line
- For: System administrators, DevOps engineers, and self-hosters looking to deflect SSH scans
- Alternative to: endlessh, Fail2ban, CrowdSec
- Tags: ssh, honeypot, security, prometheus, grafana, docker, golang

## Why it was saved

- [@brusnicadev, 16 August 2026](https://www.instagram.com/reel/DcGacI2D1gF/): Wastes bot resources for hours by pretending to be a slow server on default SSH port 22 while your real SSH daemon runs on a custom port.

## Related

- [Check SSH Brute-Force Login Attempts](https://xiry.app/resources/check-ssh-brute-force-login-attempts): Terminal commands to count and monitor failed SSH logins on Linux (Tip, Free)
- [CrowdSec](https://xiry.app/resources/crowdsec): Open-source collaborative security engine and intrusion prevention system using crowdsourced threat data. (GitHub repo, Open source)
- [Fail2Ban](https://xiry.app/resources/fail2ban): Log-monitoring daemon that dynamically blocks IP addresses causing repeated authentication failures. (GitHub repo, Open source)
- [SSH Brute-Force Protection with fail2ban and ufw](https://xiry.app/resources/ssh-brute-force-protection-with-fail2ban-and-ufw): Quick commands to detect and block SSH brute-force attacks on Linux (Tip, Free)
- [Sandbox Hardening Checklist for Code-Executing Agents](https://xiry.app/resources/sandbox-hardening-checklist-for-code-executing-agents): A three-step checklist to isolate and harden runtimes for arbitrary code execution. (Tip, Free)
- [How to self-host a Next.js app on a Hetzner VM using Kamal](https://xiry.app/resources/how-to-self-host-a-next-js-app-on-a-hetzner-vm-using-kamal): Step-by-step tutorial for deploying Next.js to Hetzner using Kamal (Article or course, Free)

Updated 3 October 2026. Page: https://xiry.app/resources/endlessh-go

Make your own library: Xiry takes your saved reels, tweets, Reddit bookmarks and Watch Later videos, makes them searchable and pulls the useful stuff out, like this library. It's invite-only for now; join the waitlist at https://xiry.app/#waitlist.