# endlessh mit Homebrew, apk, apt, dnf, Nix installieren Prüfe Installationswege, Executables, Metadaten und Sicherheitshinweise für endlessh in AI-Agent-Workflows. ## Installation ```sh sudo av install brew:endlessh ``` Weitere Installationsbefehle: ### macOS - Homebrew (100%): ```sh brew install endlessh ``` Evidenz: local Homebrew formula metadata ### Linux - apk (92%): ```sh sudo apk add endlessh ``` Evidenz: Alpine Linux edge package indexes: endlessh from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz - Debian apt (92%): ```sh sudo apt install endlessh ``` Evidenz: Debian stable package indexes: endlessh from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz - dnf (92%): ```sh sudo dnf install endlessh ``` Evidenz: Fedora Rawhide package metadata: endlessh from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst - Nix (92%): ```sh nix profile install nixpkgs#endlessh ``` Evidenz: nixpkgs package indexes: pkgs/by-name/en/endlessh/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 ## Paketfakten - **Paketschlüssel:** brew:endlessh - **Paketmanager:** Homebrew - **Paketmanager-Seite:** - **Version:** 1.1 - **Quellzusammenfassung:** SSH tarpit that slowly sends an endless banner - **Homepage:** - **Repository:** - **Upstream-Dokumentation:** - **Lizenz:** Unlicense - **Quellarchiv:** - **Generiert:** 2026-07-08T18:08:21+00:00 ## Executables - endlessh (cli) - endlessh (Alias) ## Installationsverhalten - Post-install-Hook: nicht definiert - Bottle: verfügbar auf arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, arm64_ventura, sonoma, ventura, x86_64_linux ## Version und Aktualität - Seite generiert: 2026-07-08 - Manager-Version: 1.1 - lokale Daten: OK - Upstream-Repository: https://github.com/skeeto/endlessh - neueste erkannte Version: 1.1 (aktuell) - Info: No package-manager update timestamp was available. ## Projektgeschichte und Nutzung Endlessh is an SSH tarpit: it accepts SSH connections and slowly sends an endless, random pre-authentication banner so automated clients remain tied up for a long time. Its purpose is to move the real SSH daemon elsewhere and let noisy scanners waste time on port 22. ### Projektgeschichte The author introduced Endlessh publicly in March 2019 as a small C program that exploits the SSH identification-banner phase before cryptographic negotiation. Because the tarpit happens before key exchange, the README notes that Endlessh needs no cryptographic libraries. The implementation was intentionally simple and portable: a single-threaded C server using `poll()` to handle many delayed clients. The project blog describes this as a resource-minimizing design, trading maximum platform-specific efficiency for low memory use and broad Unix portability. ### Adoptionsgeschichte Endlessh became a recognizable defensive toy-tool because it addresses a universal server-owner annoyance: constant automated SSH probing. The launch article notes discussion on Hacker News and Reddit and describes real deployments with many trapped clients. Its adoption niche is operational rather than cryptographic. Users generally run it on the public SSH port, move real SSH to another port, and tune delay, banner length, client limit, logging, and bind family through command-line flags or `/etc/endlessh/config`. ### Wie es verwendet wird The default command listens on port 2222, with a 10-second delay between banner lines and a default maximum of 4096 clients. The README and man page document flags for IPv4 or IPv6 binding, delay, config file, max line length, max clients, port, syslog, and verbosity. A sample configuration file uses OpenSSH-like syntax with `Port`, `Delay`, `MaxLineLength`, `MaxClients`, `LogLevel`, and `BindFamily`. Signals are also part of normal operation: SIGTERM shuts down cleanly, SIGHUP reloads configuration, and SIGUSR1 prints connection statistics. ### Warum Paket-Nerds sich dafür interessieren Endlessh is package-nerd significant because it is tiny, dependency-light security plumbing with a clear daemon shape. It is easy to package, easy to supervise, and easy to understand from its man page, yet it changes the economics of commodity SSH scanning. It is also a good example of a Unix package whose README is effectively the operational model: one binary, one config file, no keys, no crypto, and behavior controlled by conventional flags and signals. ### Zeitleiste - 2019: Endlessh introduced publicly in the author's blog post. - 2020: Man page date records January 29, 2020. - 2019-present: Project remains available as a small standalone C SSH tarpit. ### Related projects - OpenSSH is the operational counterpart users typically move away from the public tarpit port. - RFC 4253 is the SSH protocol behavior Endlessh relies on for pre-identification banner lines. - Other tarpits and asyncio-based tarpit sketches are discussed in the author's introductory article. ### Quellen - - - - ## Sicherheitshinweise broad file, network, media, or database tool signal. - **Geiger-Risiko:** blue / mittel - broad file, network, media, or database tool signal ## Configuration and credential file locations These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval. ## Configuration files - Unix: /etc/endlessh/config ## Details aus der Quelldatenbank - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** endlessh - **Version Scheme:** 0 - **Revision:** 0 - **Head Version:** HEAD - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** head, stable ## Andere Paketmanager-Einträge - Debian apt - endlessh - 1.1-5.1: normalized package name match | Debian stable package indexes: endlessh from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | SSH tarpit that slowly sends an endless connection banner | https://github.com/skeeto/endlessh - Nix - endlessh: normalized package name match | nixpkgs package indexes: pkgs/by-name/en/endlessh/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - Ubuntu apt - endlessh - 1.1-5: normalized package name match | Ubuntu 24.04 LTS package indexes: endlessh from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | SSH tarpit that slowly sends an endless connection banner | https://github.com/skeeto/endlessh - apk - endlessh - 1.1-r2: normalized package name match | Alpine Linux edge package indexes: endlessh from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | SSH tarpit that very slowly sends an endless, random SSH banner | https://github.com/skeeto/endlessh - apk - endlessh-doc - 1.1-r2: normalized package name match | Alpine Linux edge package indexes: endlessh-doc from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | SSH tarpit that very slowly sends an endless, random SSH banner (documentation) | https://github.com/skeeto/endlessh - dnf - endlessh - 1.1-16.fc44: normalized package name match | Fedora Rawhide package metadata: endlessh from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst | SSH tarpit that slowly sends an endless banner | https://github.com/skeeto/endlessh ## Verwandte Links - [Source-control packages](https://www.automicvault.com/de/pkg/source-control-tools/) - Belongs to a source-control command family. - [Secret-risk packages](https://www.automicvault.com/de/pkg/secret-risk-packages/) - Has protected-tool coverage, approval-gate, or non-low Geiger security signals. - [Terminal utility packages](https://www.automicvault.com/de/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Networking and protocol packages](https://www.automicvault.com/de/pkg/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [duo_unix](https://www.automicvault.com/de/pkg/brew/duo-unix/) - Shares av.db curated category or tags: cli, security, ssh. - [signmykey](https://www.automicvault.com/de/pkg/brew/signmykey/) - Shares av.db curated category or tags: cli, security, ssh. - [skm](https://www.automicvault.com/de/pkg/brew/skm/) - Shares av.db curated category or tags: cli, security, ssh. - [sshguard](https://www.automicvault.com/de/pkg/brew/sshguard/) - Shares av.db curated category or tags: cli, security, ssh. - [terrapin-scanner](https://www.automicvault.com/de/pkg/brew/terrapin-scanner/) - Shares av.db curated category or tags: cli, security, ssh. - [tkey-ssh-agent](https://www.automicvault.com/de/pkg/brew/tkey-ssh-agent/) - Shares av.db curated category or tags: cli, security, ssh. - [aide](https://www.automicvault.com/de/pkg/brew/aide/) - Shares av.db curated category or tags: cli, security. - [aircrack-ng](https://www.automicvault.com/de/pkg/brew/aircrack-ng/) - Shares av.db curated category or tags: cli, security. - [git-credential-oauth](https://www.automicvault.com/de/pkg/brew/git-credential-oauth/) - Security-sensitive metadata or terminology overlaps. Shared terms: cli, security, that. - [git-hound](https://www.automicvault.com/de/pkg/brew/git-hound/) - Security-sensitive metadata or terminology overlaps. Shared terms: cli, security, that. - [search-that-hash](https://www.automicvault.com/de/pkg/brew/search-that-hash/) - Security-sensitive metadata or terminology overlaps. Shared terms: cli, security, that. ## Combined YAML source View the package source record on GitHub. [combined/endlessh.yml](https://github.com/automic-vault/db/blob/main/combined/endlessh.yml) ## Quellen - Nucleus package database - Geiger risk classifier - package-page enrichment - curated configuration and credential file locations - curated package history - package version freshness - av.db category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph