# Install endlessh with Homebrew, apk, apt, dnf, Nix SSH tarpit that slowly sends an endless banner. Version 1.1 via Homebrew; verified from local package data. Also installable with debian: sudo apt install endlessh. ## Install ```sh sudo av install brew:endlessh ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install endlessh ``` Evidence: local Homebrew formula metadata ### Linux - apk (92%): ```sh sudo apk add endlessh ``` Evidence: Alpine Linux edge package indexes: endlessh from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz - Debian apt (92%): ```sh sudo apt install endlessh ``` Evidence: Debian stable package indexes: endlessh from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz - dnf (92%): ```sh sudo dnf install endlessh ``` Evidence: Fedora Rawhide package metadata: endlessh from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/07190dc5ae9f35ae73866675fed6d95fe6e8d9fe22c9d7cdf85862cb2ed24a4c-primary.xml.zst - Nix (92%): ```sh nix profile install nixpkgs#endlessh ``` Evidence: nixpkgs package indexes: pkgs/by-name/en/endlessh/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 ## Package facts - **Package key:** brew:endlessh - **Package manager:** Homebrew - **Version:** 1.1 - **Source summary:** SSH tarpit that slowly sends an endless banner - **Homepage:** - **Repository:** - **Generated:** 2026-08-03T19:37:03+00:00 ## Executables - endlessh (alias) ## Install behavior - Bottle: not available ## Freshness - Page generated: 2026-08-03 - Package-manager version: 1.1 ## Project history and usage Endlessh is an SSH tarpit: it accepts SSH connections and slowly sends an endless, random pre-authentication banner so automated clients remain tied up for a long time. Its purpose is to move the real SSH daemon elsewhere and let noisy scanners waste time on port 22. ### Project history The author introduced Endlessh publicly in March 2019 as a small C program that exploits the SSH identification-banner phase before cryptographic negotiation. Because the tarpit happens before key exchange, the README notes that Endlessh needs no cryptographic libraries. The implementation was intentionally simple and portable: a single-threaded C server using `poll()` to handle many delayed clients. The project blog describes this as a resource-minimizing design, trading maximum platform-specific efficiency for low memory use and broad Unix portability. ### Adoption history Endlessh became a recognizable defensive toy-tool because it addresses a universal server-owner annoyance: constant automated SSH probing. The launch article notes discussion on Hacker News and Reddit and describes real deployments with many trapped clients. Its adoption niche is operational rather than cryptographic. Users generally run it on the public SSH port, move real SSH to another port, and tune delay, banner length, client limit, logging, and bind family through command-line flags or `/etc/endlessh/config`. ### How it is used The default command listens on port 2222, with a 10-second delay between banner lines and a default maximum of 4096 clients. The README and man page document flags for IPv4 or IPv6 binding, delay, config file, max line length, max clients, port, syslog, and verbosity. A sample configuration file uses OpenSSH-like syntax with `Port`, `Delay`, `MaxLineLength`, `MaxClients`, `LogLevel`, and `BindFamily`. Signals are also part of normal operation: SIGTERM shuts down cleanly, SIGHUP reloads configuration, and SIGUSR1 prints connection statistics. ### Why package nerds care Endlessh is package-nerd significant because it is tiny, dependency-light security plumbing with a clear daemon shape. It is easy to package, easy to supervise, and easy to understand from its man page, yet it changes the economics of commodity SSH scanning. It is also a good example of a Unix package whose README is effectively the operational model: one binary, one config file, no keys, no crypto, and behavior controlled by conventional flags and signals. ### Timeline - 2019: Endlessh introduced publicly in the author's blog post. - 2020: Man page date records January 29, 2020. - 2019-present: Project remains available as a small standalone C SSH tarpit. ### Related projects - OpenSSH is the operational counterpart users typically move away from the public tarpit port. - RFC 4253 is the SSH protocol behavior Endlessh relies on for pre-identification banner lines. - Other tarpits and asyncio-based tarpit sketches are discussed in the author's introductory article. ### Sources - - - - ## Security Notes broad file, network, media, or database tool signal. - **Geiger risk:** blue / medium - broad file, network, media, or database tool signal ## Configuration and credential file locations These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval. ## Configuration files - Unix: /etc/endlessh/config ## Other Package-Manager Records - Debian apt - endlessh - 1.1-5.1: normalized package name match | Debian stable package indexes: endlessh from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | SSH tarpit that slowly sends an endless connection banner | https://github.com/skeeto/endlessh - Nix - endlessh: normalized package name match | nixpkgs package indexes: pkgs/by-name/en/endlessh/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - Ubuntu apt - endlessh - 1.1-5: normalized package name match | Ubuntu 24.04 LTS package indexes: endlessh from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | SSH tarpit that slowly sends an endless connection banner | https://github.com/skeeto/endlessh - apk - endlessh - 1.1-r2: normalized package name match | Alpine Linux edge package indexes: endlessh from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | SSH tarpit that very slowly sends an endless, random SSH banner | https://github.com/skeeto/endlessh - apk - endlessh-doc - 1.1-r2: normalized package name match | Alpine Linux edge package indexes: endlessh-doc from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | SSH tarpit that very slowly sends an endless, random SSH banner (documentation) | https://github.com/skeeto/endlessh - dnf - endlessh - 1.1-17.fc45: normalized package name match | Fedora Rawhide package metadata: endlessh from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/07190dc5ae9f35ae73866675fed6d95fe6e8d9fe22c9d7cdf85862cb2ed24a4c-primary.xml.zst | SSH tarpit that slowly sends an endless banner | https://github.com/skeeto/endlessh ## Combined YAML source View the package source record on GitHub. [combined/endlessh.yml](https://github.com/mxcl/pkgdb/blob/main/combined/endlessh.yml) ## Sources - pkg.so package database - Geiger risk classifier - curated configuration and credential file locations - curated package history - pkgdb category and tag curation - external package-manager database matches - cross-ecosystem install command graph