Endlessh

Overview

Endlessh is a free, self-hosted SSH tarpit for Linux that holds unwanted SSH clients by sending them a stream of random banner text. It suits operators who want a narrow network decoy rather than a broader honeypot; its appeal is simple deployment scope and adjustable connection handling, while its focus is also its main limitation.

Key features

Endlessh sends its banner before cryptographic negotiation, so it does not rely on cryptographic libraries. The project’s intended setup is to move a real SSH server to another port and direct unwanted SSH connections to Endlessh, where clients can remain occupied for hours or days. That is a useful diversion for SSH traffic, not a credential-capture tool: it has no credential lures.

The standalone, single-threaded C program uses poll() to manage multiple clients. Its default delay between banner messages is 10,000 milliseconds, and its maximum line length is 32 characters. The default client ceiling is 4,096; excess connections wait in a queue, so deployments facing heavier traffic should account for queued clients rather than assume every connection is handled immediately.

IPv4 and IPv6 are supported, with options to bind to only one address family. Diagnostics are quiet by default; repeatable verbosity flags enable standard and debug logs, and output can go to syslog. The OpenSSH-like configuration file defaults to /etc/endlessh/config. SIGTERM shuts down the daemon gracefully, SIGHUP reloads configuration, and SIGUSR1 writes connection statistics to the log. Build adjustments are documented for RHEL 6/CentOS 6, Solaris/illumos, and OpenBSD. Project discussion and contributions run through GitHub Issues and Pull Requests.

Pricing

Endlessh is open source under the Unlicense and costs nothing. There is no free trial because the software is free; deployment is self-hosted, so operators manage the host themselves. Its single free plan is the full SSH tarpit, a standalone C program with a default maximum of 4,096 clients—there are no paid tiers or plan-based feature trade-offs.

Platforms

Endlessh is for Linux and self-hosted deployment. Its documentation also covers build adjustments for RHEL 6/CentOS 6, Solaris/illumos, and OpenBSD, which may help operators working on those systems.

Who it's for

Choose Endlessh if you need a focused SSH decoy, can run it on your own infrastructure, and want control over logging, address-family binding, and banner behavior. It is a poor fit if you need credential lures, third-party service integrations, or a broader set of decoy services: its scope is limited to occupying SSH clients, and its documented logging destinations are standard output and syslog.

Pros and cons

• Pro: Banner delivery precedes cryptographic exchange, avoiding a dependency on cryptographic libraries for this narrow task.
• Pro: IPv4 and IPv6 support, configurable binding, and adjustable logging give operators practical control over network exposure and diagnostics.
• Pro: Free, self-hosted software with an Unlicense license has no subscription tier to budget for.
• Con: The 4,096-client default limit queues excess connections, which matters when planning for higher connection volumes.
• Con: It has no credential lures or documented third-party integrations, so it cannot serve as a credential-harvesting or integrated monitoring platform.
• Con: The Linux and self-hosted focus requires operators to provide and maintain their own deployment environment.

Alternatives

Canarytokens is another free option, with a hosted service whose tokens deployed through canarytokens.org are free, as well as Android, iOS, self-hosted, web, and Windows platforms. Choose it when token-based deployment or broader platform availability fits better than an SSH tarpit.

OpenCanary is free, open-source, and self-hosted for Linux and macOS; it may suit operators looking for an alternative self-hosted honeypot.

T-Pot is a free, open-source self-hosted option for Linux, macOS, and Windows, with hardware and network requirements to consider. It is an alternative when those platforms fit, provided its requirements are workable.

Beelzebub offers a free, self-hosted open-source core framework on Linux, with API support. Its free trial may also make it relevant to readers comparing trial availability.

Cowrie is a free, open-source SSH and Telnet honeypot for Linux and self-hosted use, licensed under BSD. Consider it when Telnet coverage or that license is preferable to Endlessh’s focused SSH tarpit.

Honeyd is distributed free of charge under GPL and supports Linux, self-hosted, and Windows use. Honeytrap is free Apache License 2.0 software for Linux and self-managed deployment. MedPot is a free Linux, self-hosted open-source repository that requires Go 1.17 or newer.

For more options, see Honeypot Software.

Verdict

Endlessh is a sensible choice for Linux operators who want a free, configurable way to keep unwanted SSH clients occupied while preserving a real SSH server on another port. Its narrow purpose and lack of credential lures are clear boundaries: choose a broader honeypot if you need more than an SSH tarpit.