// the find
shizunge/endlessh-go
A golang implementation of endlessh (SSH tarpit) exporting Prometheus metrics, visualized by a Grafana dashboard.
A Go reimplementation of the SSH tarpit endlessh, which keeps attackers connected indefinitely by sending an infinitely slow SSH banner. The main addition over the original C version is Prometheus metrics export and a Grafana dashboard for visualizing where attacks originate geographically. For anyone running public-facing SSH who wants both the tarpit effect and visibility into who's scanning them.
The Prometheus metrics include per-IP labels with geohash and country, so you get a world map of attackers in Grafana without any log parsing. Multi-port support is a practical addition — you can tar-pit multiple ports simultaneously with one process. The Docker image is small and the compose examples are complete enough to spin up the full stack (Prometheus + Grafana + endlessh-go) in minutes. Proxy protocol support means you can put it behind a load balancer without losing the real attacker IPs.
The per-IP Prometheus labels are a cardinality time bomb on busy servers — with thousands of unique attacker IPs over time, your Prometheus memory usage will balloon unless you set `-prometheus_clean_unseen_seconds`. The default for that flag is 0 (disabled), which is the wrong default. The GeoIP story requires either a rate-limited third-party HTTP call to ip-api (bad for high traffic) or manually maintaining a MaxMind database file — neither is great. At 1271 stars and 44 forks the community is small, so if you hit a weird edge case you're largely on your own. The codebase is a single-maintainer project with no indication of an active contributor bench.