Endlessh

Endlessh is a lightweight SSH tarpit that occupies automated attackers by slowly transmitting an endless, randomly generated protocol banner. Administrators can move their real SSH service to another port and place Endlessh on the commonly scanned port. Because it delays clients before cryptographic negotiation begins, the program requires no cryptographic library. Its single-threaded C implementation uses poll to maintain many simultaneous connections efficiently. Configuration options control the listening port, transmission delay, banner line length, client limit, address family, and logging level. Signals support graceful shutdowns, configuration reloads, and connection-statistics reporting. The project can run directly on Unix-like systems or inside a Docker container.