Endlessh is a deliberately slow SSH listener: it accepts automated connections and emits an endless stream of random banner text before SSH cryptographic negotiation. Scanners can remain tied up for hours or days while your real OpenSSH daemon continues serving administrators on a different port.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
On Ubuntu 22.04, the safe order is important. Keep an existing administrative session open, move OpenSSH to a replacement port, prove that a second session works, build Endlessh, configure it, and only then assign the original SSH port to the tarpit. This guide follows that order and includes verification, hardening, configuration choices, and rollback.
What Endlessh does—and what it does not do
Endlessh is a standalone, single-threaded C program that acts as an SSH tarpit. Instead of completing the SSH handshake, it very slowly sends an endless, random SSH banner. Automated clients that connect to the listener wait for more protocol data and keep their connection open.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →The tarpit is not a replacement for OpenSSH, an intrusion-prevention system, or a firewall. It does not authenticate users, provide a shell, or protect the management service by itself. Its useful role is to occupy scanners and other clients that probe the port you expose, while administrators use a separate, known OpenSSH port.
As an Amazon Associate I earn from qualifying purchases.
The Ubuntu 22.04 procedure below builds the program from the upstream source, installs the binary at /usr/local/bin/endlessh, and runs it under a hardened systemd unit. No controlled Ubuntu 22.04 benchmark establishes a particular CPU, memory, or bot-capture rate, so this guide does not promise performance figures.
Plan the ports before changing SSH
You need two TCP listeners:
- Management port: the new, non-standard port used by OpenSSH for your own administration. The example below uses
22022; choose a port that your firewall and operating procedures allow. - Tarpit port: the port Endlessh will occupy. For a classic deployment this is port
22. For a lower-risk trial, use an unprivileged port such as the upstream default2222.
Do not close the SSH session you are using while changing the configuration. If the replacement port fails, that open session is your recovery path.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Back up and validate the OpenSSH configuration
- Back up the current file:
sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.before-endlessh - Edit the configuration:
sudo nano /etc/ssh/sshd_configSet the active
Portdirective to your management port, for examplePort 22022. Remove or update any conflicting activePortlines; comments beginning with#do not apply. - Check the syntax before reloading:
sudo sshd -tA command that returns no output indicates that the file passed the syntax check. Correct any reported error before continuing.
- Reload OpenSSH so existing sessions remain available:
sudo systemctl reload sshIf your host does not support reload for the installed unit, use a restart only while keeping the original session open.
- From a different terminal, connect to the replacement port and prove that it works. For example:
ssh -p 22022 your-user@server-addressDo not proceed until this second connection reaches the normal OpenSSH login.
Open the firewall paths
Allow the management port before relying on it, and allow the tarpit port if you intend it to be reachable from the networks you are studying. Apply the rule set used by your host or cloud firewall, then verify that both ports are permitted. A tarpit that is blocked at the perimeter will not receive connections; a management port that is blocked can lock you out.
Install the Ubuntu 22.04 build dependencies
Install the compiler, development headers, Git, and Make used by the documented build:
sudo apt update
sudo apt install build-essential libc6-dev git makeThe documented dependency command is often shown without make because it is included by build-essential; listing it explicitly makes the requirement clear. If APT reports that a package is already installed, that is normal.
Fetch and build Endlessh
Clone the upstream Endlessh repository using the repository address published by the project, then enter the checkout. Because the project can change its default branch over time, use the revision you have reviewed rather than assuming that a particular branch name is permanent.
Free tools Windows power users keep installed
One-click scans. No signup required.
cd ~
# Clone the upstream Endlessh repository here, using its official repository URL.
cd endlessh
makeA successful build produces the endlessh executable in the checkout. Install it in the system-wide location used by the service unit:
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
sudo install -m 0755 endlessh /usr/local/bin/endlesshConfirm that the file exists and is executable:
ls -l /usr/local/bin/endlesshKeep the source checkout until you are satisfied with the deployment. It is useful for reviewing the service file and rebuilding when you deliberately update the program.
Install the systemd service
The upstream checkout includes util/endlessh.service. Copy that unit into systemd’s local unit directory:
sudo install -m 0644 util/endlessh.service /etc/systemd/system/endlessh.serviceThe unit starts /usr/local/bin/endlessh, waits for network-online.target, restarts after a failure, and applies filesystem, device, kernel, and privilege hardening. Inspect the copied file before enabling it so you understand the command and restrictions your revision contains:
sudo systemctl cat endlesshDo not enable the service yet. Create and review its configuration first.
Create /etc/endlessh/config
Create the configuration directory and file:
sudo install -d -m 0755 /etc/endlessh
sudo nano /etc/endlessh/configA conservative trial configuration using an unprivileged port is:
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Port 2222
Delay 10000
MaxLineLength 32
MaxClients 4096
LogLevel 1
BindFamily 0Save the file, then choose the settings that match your deployment. The values above are the upstream defaults for the banner delay, maximum line length, and client limit.
Port
Port is the TCP port Endlessh listens on. Use 2222 for a first deployment that avoids privileged-port capabilities, or use 22 after OpenSSH has been moved and you have completed the capability steps below.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Delay
Delay is the pause between banner lines, measured in milliseconds. The upstream default is 10000, or 10 seconds. A larger value holds each client longer but sends data less frequently; a smaller value produces a more active stream and may change the resource profile. Treat the setting as an operational choice, not a guaranteed bot-retention time.
MaxLineLength
MaxLineLength sets the randomized maximum banner-line length. The upstream default is 32 characters. It controls the shape of the random output, not the total lifetime of a connection.
MaxClients
MaxClients limits concurrent clients. The upstream default is 4096 door? No—use the exact numeric value 4096. Set a lower limit if you want a deliberately bounded listener, and monitor the service when changing it. There is no published Ubuntu 22.04 test that maps this limit to a particular memory footprint.
LogLevel
0: quiet.1: standard service messages.2: noisy debugging output.
Begin with level 1. Temporarily use level 2 when diagnosing startup or connection behavior, then return to the least verbose level that gives you the information you need.
BindFamily
0: IPv4-mapped IPv6 or dual-stack behavior, depending on the host’s socket configuration.4: IPv4 only.6: IPv6 only.
Select the family that matches the addresses your firewall exposes. A listener restricted to IPv4 will not accept IPv6 probes, and the reverse is also true.
Bind to port 22 with the documented capability changes
Ports below 1024 normally require elevated privilege. The upstream unit documents a capability-based approach rather than running the process as unrestricted root. If you are testing on 2222, skip this section. If your configuration contains Port 22, complete every step.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
- Grant only the bind capability to the installed executable:
sudo setcap 'cap_net_bind_service=+ep' /usr/local/bin/endlessh - Edit the unit:
sudo nano /etc/systemd/system/endlessh.serviceUncomment
AmbientCapabilities=CAP_NET_BIND_SERVICE. - In the same unit, comment out
PrivateUsers=true. The upstream instructions require this change for the ambient capability to work with the privileged listener. - Save the file and inspect the relevant lines:
sudo systemctl cat endlessh
These changes are specific to the privileged-port setup. If you later move Endlessh back to an unprivileged port, remove capability-related changes only after stopping the service and deciding whether the executable should retain its file capability.
Enable and start Endlessh
- Ask systemd to reread the unit:
sudo systemctl daemon-reload - Enable the service at boot and start it immediately:
sudo systemctl --now enable endlessh - Check its state:
sudo systemctl status endlesshThe expected state is
active (running). - If the service is not running, read the recent journal before changing files:
sudo journalctl -u endlessh -n 50 --no-pagerLook for an address-in-use error, a permission or capability failure, a missing configuration file, or a systemd hardening restriction.
Do not test from the same administrative connection you need for recovery. Keep the management SSH session open and use another terminal or host.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Verify both listeners
Verify the service state
Run:
sudo systemctl status endlesshConfirm that systemd reports active (running) and that the process has not entered a rapid restart loop. If you changed the unit or configuration after starting it, run sudo systemctl restart endlessh and check the status again.
Test the tarpit from a separate terminal
Connect to the tarpit port with an SSH client, for example:
ssh -p 22 your-user@server-addressUse 2222 instead if that is the value in your configuration. The client should remain occupied while Endlessh slowly emits banner data and should not reach an authentication prompt. Stop the test with Ctrl+C. A client that exits immediately usually indicates that another service owns the port, a firewall or network device is rejecting the connection, or Endlessh is not listening on the address family you selected.
Prove that administration still works
Open a separate connection to the replacement OpenSSH port:
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesssh -p 22022 your-user@server-addressThis must still produce a normal OpenSSH login. Treat this connection as the recovery channel until you have completed testing and documented the final port layout.
Troubleshooting by symptom
Endlessh fails with “address already in use”
Another process is listening on the configured port, or OpenSSH was not actually moved. Check the listening sockets with the tools already available on the host, identify the owner, and resolve the conflict before restarting Endlessh. Do not stop an unknown listener on a production server.
Port 22 gives “permission denied” or the service exits
Verify that the file capability was applied to the exact binary path, that AmbientCapabilities=CAP_NET_BIND_SERVICE is active, and that PrivateUsers=true is commented as required by the upstream privileged-port instructions. Run sudo systemctl daemon-reload after editing the unit, then inspect the journal.
The service starts but the test connection closes
Check that the test uses the configured port and address family. Review LogLevel 2 temporarily, inspect the journal, and confirm that no firewall, load balancer, or upstream security group is terminating the connection. Return to LogLevel 1 after diagnosis.
Recommended Free Tools
IPv4 works but IPv6 does not, or vice versa
Review BindFamily. Set 4 for IPv4-only, 6 for IPv6-only, or 0 for the upstream dual-stack behavior, then restart the service and test through the corresponding address.
The replacement SSH port is unreachable
Keep the original session open, confirm the new Port directive with sudo sshd -T | grep -i '^port ', verify firewall rules, and check the SSH journal. If necessary, restore the previous configuration from the backup in the existing session, run sudo sshd -t, and reload OpenSSH before attempting another port move.
Rollback and safe removal
To stop and disable the tarpit:
sudo systemctl --now disable endlesshConfirm that it is stopped before restoring OpenSSH to port 22. In the still-open management session:
- Edit
/etc/ssh/sshd_configand restore the previousPortvalue. - Validate it with
sudo sshd -t. - Reload OpenSSH with
sudo systemctl reload ssh. - Test a new connection on the restored port before closing the management session.
If you no longer need Endlessh, remove or archive /etc/endlessh/config, the service unit, and the installed binary only after confirming that no automation depends on them. If you granted a file capability, inspect it with getcap /usr/local/bin/endlessh and remove the binary when uninstalling rather than leaving an unused privileged executable behind.
Quick Recap
Operational checklist
- Keep one known-good SSH session open during every port change.
- Back up
/etc/ssh/sshd_configand runsudo sshd -tbefore reloading. - Verify a second login on the replacement OpenSSH port.
- Allow both management and tarpit ports through the relevant firewall layers.
- Use
2222first if you want to avoid privileged-port capability changes. - For port 22, apply the capability, ambient-capability, and
PrivateUserschanges exactly as documented. - Run
sudo systemctl daemon-reloadafter editing the unit. - Expect
active (running)fromsystemctl status endlessh. - Test the tarpit from another terminal and stop the test with
Ctrl+C. - Do not infer CPU, memory, or bot-capture performance from the default values; no controlled Ubuntu 22.04 figures establish those outcomes.
Configuration quick reference
| Setting | Meaning | Upstream default or values | Practical choice |
|---|---|---|---|
Port |
TCP listener port | 2222 |
Use 2222 for an unprivileged trial or 22 after moving OpenSSH and applying capability instructions |
Delay |
Milliseconds between banner lines | 10000 |
Increase for slower output; decrease only when you have a reason to send data more frequently |
MaxLineLength |
Randomized maximum banner-line length | 32 |
Keep the default unless you need a different banner shape |
MaxClients |
Maximum concurrent clients | 4096 |
Choose a lower ceiling when you want an explicit connection bound |
LogLevel |
Service logging verbosity | 0, 1, or 2 |
Use 1 normally and 2 temporarily for diagnosis |
BindFamily |
Address family | 0, 4, or 6 |
Match the IP versions exposed by your firewall and network |
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
