Confuse Some SSH Bots and Make Botters Block You
Key topics
A clever tactic to deter SSH bots involves deliberately introducing incompatibilities that cause them to hang or crash, effectively excluding the server from future scans. Commenters chimed in with their experiences, noting that Paramiko v4.0.0 can bypass the initial version string check but fails on the key exchange, while others pointed out that a "properly designed" bot wouldn't be fooled by such tactics. The discussion highlights the cat-and-mouse game between server administrators and bot operators, with some advocating for a more straightforward approach like hiding SSH behind Wireguard. As it turns out, this tactic can be so effective that it even confused some legitimate users, with one commenter being served a Rick Astley quote instead of the expected content.
Snapshot generated from the HN discussion
Discussion Activity
Very active discussionFirst comment
37m
Peak period
22
120-132h
Avg / period
6.4
Based on 32 loaded comments
Key moments
- 01Story posted
Dec 11, 2025 at 2:11 PM EST
25 days ago
Step 01 - 02First comment
Dec 11, 2025 at 2:48 PM EST
37m after posting
Step 02 - 03Peak activity
22 comments in 120-132h
Hottest window of the conversation
Step 03 - 04Latest activity
Dec 18, 2025 at 12:37 PM EST
18 days ago
Step 04
Generating AI Summary...
Analyzing up to 500 comments to identify key contributors and discussion patterns
Want the full context?
Jump to the original sources
Read the primary article or dive into the live Hacker News thread when you're ready.
[1] - https://www.ssh-audit.com/
Thus far I am letting some leak through.
- Blackhole routed a few ASN's / data-centers. It's all spoofed packets but good to block data-centers regardless so we are not sending them syn-ack (good hygiene).
- Added a temporary rule when we encounter a syn-flood. [1]
End result: Input 20 packets in 17 seconds, Output syn-ack reply 20 packets in 4 minutes and 44 seconds. That should translate to an acceptable amount of syn-ack if we were actually attacked some day.
Impact: Before, we sent more syn-ack then I would have liked but there was overall no impact to Nginx as we use the "deferred" socket option [2]. Now we send far fewer syn-ack packets for good internet hygiene. Thank-you to the person using the syn flood tool.
[1] - https://mirror.newsdump.org/nftables.txt
[2] - https://mirror.newsdump.org/nginx/http.d/11_bad_sni.conf.txt
[1] - https://bgp.tools/as-set/RIPE::as-stormwall-set#reverse
[1] - https://www.whatsmyip.org/more-info-about-you/
Why does this happen, wouldn't bots just ignore the version information?
Silent by default.
And good choice on the wireguard only, only issue I had is devops/testing things and not being connected to the wireguard because I'd be connected to another wireguard and couldn't ssh in to the server.
WireGuard _all_ of the things
How does an initial connection work in that scheme?
Seems like a pretty big footgun for questionable benefit, since a main benefit of Wireguard is that it’s very lean in terms of resources.
Turns out switching from Firefox mobile to Chrome mobile "fixes" this. Thanks for supporting the free and open internet.
The goal here is to show people some of the things that can be done not that they should do them. It's up to each person to experiment and determine what tickles their fancy.
[1] - https://thejh.net/misc/website-terminal-copy-paste
It's only a risk if someone on your team runs the script.
I personally find it extremely useful when working with servers more than 100ms or so away in many contexts, and even closer if the workflow requires making many short-lived connections.
No, it means anyone that can get your team to execute a script can log in as you in any data-center you have authenticated to regardless of multi-factor authentication without using credentials. It means firewalls do not exist, CVE's not required and credentials are not required.
I personally find it extremely useful
Absolutely, not using credentials and riding the existing channels will always be faster. Removing authentication requirements will always reduce friction.
The extremely large banner in this example is hilarious.