https://github.com/shizunge/endlessh-go Skip to content Toggle navigation Sign in * Product + Actions Automate any workflow + Packages Host and manage packages + Security Find and fix vulnerabilities + Codespaces Instant dev environments + Copilot Write better code with AI + Code review Manage code changes + Issues Plan and track work + Discussions Collaborate outside of code Explore + All features + Documentation + GitHub Skills + Blog * Solutions For + Enterprise + Teams + Startups + Education By Solution + CI/CD & Automation + DevOps + DevSecOps Resources + Learning Pathways + White papers, Ebooks, Webinars + Customer Stories + Partners * Open Source + GitHub Sponsors Fund open source developers + The ReadME Project GitHub community articles Repositories + Topics + Trending + Collections * Pricing Search or jump to... Search code, repositories, users, issues, pull requests... Search [ ] Clear Search syntax tips Provide feedback We read every piece of feedback, and take your input very seriously. [ ] [ ] Include my email address so I can be contacted Cancel Submit feedback Saved searches Use saved searches to filter your results more quickly Name [ ] Query [ ] To see all available qualifiers, see our documentation. Cancel Create saved search Sign in Sign up You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session. Dismiss alert {{ message }} shizunge / endlessh-go Public * Notifications * Fork 14 * Star 448 * A golang implementation of endlessh exporting Prometheus metrics, visualized by a Grafana dashboard. License GPL-3.0 license 448 stars 14 forks Branches Tags Activity Star Notifications * Code * Issues 7 * Pull requests 7 * Actions * Projects 0 * Security * Insights Additional navigation options * Code * Issues * Pull requests * Actions * Projects * Security * Insights shizunge/endlessh-go This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository. main BranchesTags Go to file Code Folders and files Name Name Last commit message Last commit date Latest commit History 212 Commits .github .github client client dashboard dashboard examples examples geoip geoip metrics metrics .gitignore .gitignore Dockerfile Dockerfile LICENSE LICENSE README.md README.md go.mod go.mod go.sum go.sum main.go main.go View all files Repository files navigation * README * GPL-3.0 license endlessh-go A golang implementation of endlessh exporting Prometheus metrics, visualized by a Grafana dashboard. screenshot Introduction Endlessh is a great idea that not only blocks the brute force SSH attacks, but also wastes attackers time as a kind of counter-attack. Besides trapping the attackers, I also want to visualize the Geolocations and other statistics of the sources of attacks. Unfortunately the wonderful original C implementation of endlessh only provides text based log, but I do not like the solution that writes extra scripts to parse the log outputs, then exports the results to a dashboard, because it would introduce extra layers in my current setup and it would depend on the format of the text log file rather than some structured data. Thus I create this golang implementation of endlessh to export Prometheus metrics and a Grafana dashboard to visualize them. If you want a dashboard of sources of attacks and do not mind the endlessh server, besides trapping the attackers, does extra things including: translating IP to Geohash, exporting Prometheus metrics, and using more memory (about 10MB), this is the solution for you. Getting Started Clone the repo then build from source: go build . ./endlessh-go & Alternatively, you can use the docker image: docker run -d -p 2222:2222 shizunge/endlessh-go -logtostderr -v=1 It listens to port 2222 by default. Then you can try to connect to the endlessh server. Your SSH client should hang there. ssh -p 2222 localhost If you want log like the C implementation, you need to set both CLI arguments -logtostderr and -v=1, then the log will go to stderr. You can set different log destinations via CLI arguments. Also check out examples for the setup of the full stack. Usage ./endlessh-go --help Usage of ./endlessh-go -alsologtostderr log to standard error as well as files -conn_type string Connection type. Possible values are tcp, tcp4, tcp6 (default "tcp") -enable_prometheus Enable prometheus -geoip_supplier string Supplier to obtain Geohash of IPs. Possible values are "off", "ip-api", "max-mind-db" (default "off") -host string SSH listening address (default "0.0.0.0") -interval_ms int Message millisecond delay (default 1000) -line_length int Maximum banner line length (default 32) -log_backtrace_at value when logging hits line file:N, emit a stack trace -log_dir string If non-empty, write log files in this directory -log_link string If non-empty, add symbolic links in this directory to the log files -logbuflevel int Buffer log messages logged at this level or lower (-1 means don't buffer; 0 means buffer INFO only; ...). Has limited applicability on non-prod platforms. -logtostderr log to standard error instead of files -max_clients int Maximum number of clients (default 4096) -max_mind_db string Path to the MaxMind DB file. -port value SSH listening port. You may provide multiple -port flags to listen to multiple ports. (default "2222") -prometheus_clean_unseen_seconds int Remove series if the IP is not seen for the given time. Set to 0 to disable. (default 0) -prometheus_entry string Entry point for prometheus (default "metrics") -prometheus_host string The address for prometheus (default "0.0.0.0") -prometheus_port string The port for prometheus (default "2112") -stderrthreshold value logs at or above this threshold go to stderr (default 2) -v value log level for V logs -vmodule value comma-separated list of pattern=N settings for file-filtered logging Metrics Endlessh-go exports the following Prometheus metrics. Metric Type Description Total number of clients endlessh_client_open_count_total count that tried to connect to this host. Total number of clients endlessh_client_closed_count_total count that stopped connecting to this host. Total bytes sent to endlessh_sent_bytes_total count clients that tried to connect to this host. endlessh_trapped_time_seconds_total count Total seconds clients spent on endlessh. Number of connections of clients. Labels: * ip: Remote IP of the client * local_port: Local port endlessh_client_open_count count the program listens to * country: Country of the IP * location: Country, Region, and City * geohash: Geohash of the location Seconds a client spends on endlessh. Labels: endlessh_client_trapped_time_seconds count * ip: Remote IP of the client * local_port: Local port the program listens to The metrics is off by default, you can turn it via the CLI argument -enable_prometheus. It listens to port 2112 and entry point is /metrics by default. The port and entry point can be changed via CLI arguments. The endlessh-go server stores the geohash of attackers as a label on endlessh_client_open_count, which is also off by default. You can turn it on via the CLI argument -geoip_supplier. The endlessh-go uses service from ip-api, which may enforce a query rate and limit commercial use. Visit their website for their terms and policies. You could also use an offline GeoIP database from MaxMind by setting -geoip_supplier to max-mind-db and -max_mind_db to the path of the database file. Dashboard The dashboard requires Grafana 8.2. You can import the dashboard from Grafana.com using ID 15156 The dashboard visualizes data for the selected time range. The IP addresses are clickable and link you to the ARIN database. Contacts If you have any problems or questions, please contact me through a GitHub issue About A golang implementation of endlessh exporting Prometheus metrics, visualized by a Grafana dashboard. Topics ssh monitoring grafana prometheus grafana-dashboard Resources Readme License GPL-3.0 license Activity Stars 448 stars Watchers 4 watching Forks 14 forks Report repository Releases 23 2024.0119.1 Latest Jan 20, 2024 + 22 releases Packages 2 Contributors 3 * @shizunge shizunge Shizun Ge * @dependabot[bot] dependabot[bot] * @olofvndrhr olofvndrhr Ivan Schaller Languages * Go 98.2% * Dockerfile 1.8% Footer (c) 2024 GitHub, Inc. Footer navigation * Terms * Privacy * Security * Status * Docs * Contact * Manage cookies * Do not share my personal information You can't perform that action at this time.