@@ -17081,6 +17081,30 @@ may cause undefined behaviour.
@end table
@end deftp
+@cindex Endlessh
+@deffn {Scheme Variable} endlessh-service-type
+This is the type for the @uref{https://github.com/skeeto/endlessh,
+Endlessh} program that delays ssh clients for days at a time by
+@emph{very slowly} sending a random and endless SSH banner. The smart
+hacker will put endlessh running on port 22, and let crackers get stuck
+in this tarpit. This lets your real ssh server run more securely on a
+non-standard port.
+
+@end deffn
+
+@deftp {Data Type} endlessh-configuration
+Data type representing the configuration for @code{endlessh-service}.
+@table @asis
+@item @code{package} (default: @var{endlessh})
+@code{endlessh} package to use.
+
+@item @code{config-file} (default: @var{"%default-endlessh-config-file"})
+The config file that endlessh should use.
+
+@end table
+@end deftp
+
+
@cindex WebSSH
@deffn {Scheme Variable} webssh-service-type
This is the type for the @uref{https://webssh.huashengdun.org/, WebSSH}
@@ -1,11 +1,12 @@
;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2014, 2015, 2016, 2017, 2018, 2019 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2014, 2015, 2016, 2017, 2018, 2019, 2021 Ludovic Courtès <ludo@gnu.org>
;;; Copyright © 2016 David Craven <david@craven.ch>
;;; Copyright © 2016 Julien Lepiller <julien@lepiller.eu>
;;; Copyright © 2017 Clément Lassieur <clement@lassieur.org>
;;; Copyright © 2019 Ricardo Wurmus <rekado@elephly.net>
;;; Copyright © 2020 pinoaffe <pinoaffe@airmail.cc>
;;; Copyright © 2020 Oleg Pykhalov <go.wigust@gmail.com>
+;;; Copyright © 2021 Joshua Branson <jbranso@dismail.de>
;;;
;;; This file is part of GNU Guix.
;;;
@@ -54,6 +55,11 @@
autossh-configuration?
autossh-service-type
+ endlessh-configuration
+ endlessh-configuration?
+ endlessh-service-type
+ %default-endlessh
+
webssh-configuration
webssh-configuration?
webssh-service-type
@@ -739,6 +745,88 @@ object."
autossh-service-activation)))
(default-value (autossh-configuration))))
+
+;;;
+;;; Endlessh
+;;;
+
+(define-record-type* <endlessh-configuration>
+ endlessh-configuration make-endlessh-configuration
+ endlessh-configuration?
+ (package endlessh-configuration-package
+ (default endlessh))
+ (config-file endlessh-configuration-config-file
+ (default %default-endlessh-config-file)))
+
+(define %default-endlessh-config-file
+ (plain-file "endlessh.conf"
+ "# The port on which to listen for new SSH connections.
+Port 22
+
+# The endless banner is sent one line at a time. This is the delay
+# in milliseconds between individual lines.
+Delay 10000
+
+# The length of each line is randomized. This controls the maximum
+# length of each line. Shorter lines may keep clients on for longer if
+# they give up after a certain number of bytes.
+MaxLineLength 32
+
+# Maximum number of connections to accept at a time. Connections beyond
+# this are not immediately rejected, but will wait in the queue.
+MaxClients 4096
+
+# Set the detail level for the log.
+# 0 = Quiet
+# 1 = Standard, useful log messages
+# 2 = Very noisy debugging information
+LogLevel 0
+
+# Set the family of the listening socket
+# 0 = Use IPv4 Mapped IPv6 (Both v4 and v6, default)
+# 4 = Use IPv4 only
+# 6 = Use IPv6 only
+BindFamily 0"))
+
+(define endlessh-shepherd-service
+ (match-lambda
+ (($ <endlessh-configuration> package config-file)
+ (with-imported-modules (source-module-closure
+ '((gnu build shepherd)
+ ;; TODO add optional logging
+ ;;(gnu system file-systems)
+ ))
+ (list (shepherd-service
+ (documentation "Run the endlessh daemon.")
+ (provision '(endlessh))
+ (requirement '(networking))
+ (modules '((gnu build shepherd)
+ ;; TODO add optional logging
+ ;;(gnu system file-systems)
+ ))
+ (start #~(make-forkexec-constructor/container
+ (list #$(file-append package "/bin/endlessh")
+ "-f" #$config-file)
+ ;; TODO add optional logging
+ ;; #:mappings (list (file-system-mapping
+ ;; (source "/dev/log") ;for syslog
+ ;; (target source)))
+ ))
+ (stop #~(make-kill-destructor))))))))
+
+(define endlessh-service-type
+ (service-type
+ (name 'endlessh)
+ (description "Endlessh is an SSH tarpit that very slowly sends an endless,
+random SSH banner. It keeps SSH clients locked up for hours or even days at a
+time. The purpose is to put your real SSH server on another port and then let
+the script kiddies get stuck in this tarpit instead of bothering a real
+server.")
+ (extensions
+ (list (service-extension
+ shepherd-root-service-type endlessh-shepherd-service)))
+ (default-value (endlessh-configuration))))
+
;;;
;;; WebSSH