Repolode
Submit
shizunge

shizunge/endlessh-go

A Go implementation of the endlessh SSH tarpit that exports Prometheus metrics and ships with a Grafana dashboard for attacker statistics.

View on GitHub
Stars
1,455
Forks
55
Open issues
18
Last commit
8 days ago

What is it?

endlessh-go is a Go port of endlessh, a tarpit that accepts SSH connections and slowly sends banner lines so that brute-force bots stay connected for as long as possible. Instead of only writing text logs like the original C version, it exposes structured Prometheus metrics covering connection counts, bytes sent, and trapped time.

The server can optionally resolve each attacker IP to a geohash using ip-api or an offline MaxMind database, and attaches country, location, and geohash as labels. A Grafana dashboard (also available on grafana.com as ID 15156) visualizes these metrics over a selected time range, with IP addresses linking to ARIN lookups.

The project runs as a standalone binary or Docker container, listens on port 2222 by default, supports multiple ports and PROXY protocol headers, and includes an optional HTTP healthcheck endpoint. Memory use is noted as roughly 10MB more than the C implementation when metrics are enabled.

Key features

  • 01Exports connection counts, bytes sent, and trapped time as Prometheus metrics.
  • 02Resolves attacker IPs to country, location, and geohash via ip-api or a MaxMind database.
  • 03Includes a Grafana dashboard for visualizing attack sources over time.
  • 04Supports multiple listening ports, IPv4/IPv6 selection, and PROXY protocol headers.
  • 05Provides an optional HTTP healthcheck endpoint and a Docker image with a built-in HEALTHCHECK.

Use cases

  • Monitoring SSH brute-force traffic hitting a public server and seeing where it comes from.
  • Feeding attacker statistics into an existing Prometheus and Grafana stack.
  • Trapping automated SSH scanners to waste their time while keeping real sshd on another port.

Quick start

  1. 1

    Clone the repo and build from source

    go build .
  2. 2

    Run the server

    ./endlessh-go &
  3. 3

    Connect to test the tarpit (client should hang)

    ssh -p 2222 localhost

Things to know

  • Enabling GeoIP lookups via ip-api may be subject to rate limits and commercial use restrictions.
  • Uses about 10MB more memory than the original C implementation.
  • Licensed under GPL-3.0, a copyleft license.

Topics

#ssh#honeypot#prometheus#grafana#monitoring#security#grafana-dashboard

FAQ

What is endlessh-go?
A Go implementation of the endlessh SSH tarpit that exports Prometheus metrics and ships with a Grafana dashboard for attacker statistics. endlessh-go is a Go port of endlessh, a tarpit that accepts SSH connections and slowly sends banner lines so that brute-force bots stay connected for as long as possible. Instead of only writing text logs like the original C version, it exposes structured Prometheus metrics covering connection counts, bytes sent, and trapped time.
Is endlessh-go free to use? What license does it have?
endlessh-go is open source under the GPL-3.0 license. Check the license terms before using it in commercial products.
Is endlessh-go still maintained?
Actively maintained. The last commit to endlessh-go was on Oct 13, 2026.
What can I use endlessh-go for?
Monitoring SSH brute-force traffic hitting a public server and seeing where it comes from. Feeding attacker statistics into an existing Prometheus and Grafana stack. Trapping automated SSH scanners to waste their time while keeping real sshd on another port.
How do I install endlessh-go?
Clone the repo and build from source: go build . Run the server: ./endlessh-go & Connect to test the tarpit (client should hang): ssh -p 2222 localhost
Where can I get endlessh-go?
The source code and installation instructions are on GitHub: https://github.com/shizunge/endlessh-go

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects