{"id":13453190,"url":"https://github.com/benjojo/totp-ssh-fluxer","last_synced_at":"2026-02-06T16:36:32.199Z","repository":{"id":45668526,"uuid":"59428917","full_name":"benjojo/totp-ssh-fluxer","owner":"benjojo","description":"Take security by obscurity to the next level (this is a bad idea, don't really use this please)","archived":false,"fork":false,"pushed_at":"2022-08-31T19:32:06.000Z","size":3,"stargazers_count":929,"open_issues_count":2,"forks_count":43,"subscribers_count":32,"default_branch":"master","last_synced_at":"2025-03-14T22:36:21.326Z","etag":null,"topics":["iptables","obscurity","ssh","totp"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/benjojo.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2016-05-22T18:55:16.000Z","updated_at":"2025-03-05T21:45:46.000Z","dependencies_parsed_at":"2023-01-16T16:45:08.002Z","dependency_job_id":null,"html_url":"https://github.com/benjojo/totp-ssh-fluxer","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/benjojo%2Ftotp-ssh-fluxer","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/benjojo%2Ftotp-ssh-fluxer/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/benjojo%2Ftotp-ssh-fluxer/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/benjojo%2Ftotp-ssh-fluxer/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/benjojo","download_url":"https://codeload.github.com/benjojo/totp-ssh-fluxer/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":245194201,"owners_count":20575724,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["iptables","obscurity","ssh","totp"],"created_at":"2024-07-31T08:00:34.347Z","updated_at":"2026-02-06T16:36:32.147Z","avatar_url":"https://github.com/benjojo.png","language":"Go","funding_links":[],"categories":["Go","Apps"],"sub_categories":["*SSH* keys / Authentication"],"readme":"TOTP SSH port fluxing\n===\n\nSome people change their SSH port on their servers so that it is slightly harder to find for bots or other nasties, and while that is generally viewed as an action of [security through obscurity](https://en.wikipedia.org/wiki/Security_through_obscurity) it does work very well at killing a lot of the automated logins you always see in `/var/log/auth.log`\n\nHowever what if we could go take this to a ridiculous level? What if we could use [TOTP](https://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm) codes that are normally used as 2nd factor codes to login to websites to actually know what port the sshd server is listening on?\n\nFor this, I present [totp-ssh-flux](https://github.com/benjojo/totp-ssh-fluxer), a way to make sure your sshd port changes every 30 seconds, and possibly causing your adversaries a small period of frustration.\n\nDemo:\n\n![gif](https://blog.benjojo.co.uk/asset/O7HwIbd7i0)\n\nWhat you can see here is my phone (using a generic TOTP client) generating codes, that I can then use as the port to SSH into on a server.\n\nThe software behind it is fairly simple, It runs in a loop that does the following\n\n* Generates a TOTP token\n* Takes the last digit, if the result is above 65536, do that again\n* Adds a iptables PREROUTING rule to redirect that number generated above\n* Waits 30 seconds, removes that rule, repeat.\n\nThe neat thing is, because this is done in `PREROUTING`, even if the code expires, established connections stay connected.\n\n## Installation\n\n### You will most likely find more up to date instructions on the [totp-ssh-flux](https://github.com/benjojo/totp-ssh-fluxer) project readme\n\n### Beware, currently I would not really recommend running this software, it was only written as a joke.\n\nAt the time of writing the project is just a single file, You will need to install [golang](https://golang.org/) and then `go get` and `go build`\n\nRun the program as root ( it needs to, sorry, it's editing iptables )\n\nUpon first run, the program will generate a token for the host in `/etc/ssh-flux-key` ( you can use the `-keypath` option to change that ) and you can input that into your phone or other clients.\n\n\nYou can confirm it works by running `watch iptables -vL -t nat` and waiting for the iptables rules to be inserted and removed.\n\n---\n\nWant to see more insanity like this? Follow me on twitter [@benjojo12](https://twitter.com/Benjojo12)","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbenjojo%2Ftotp-ssh-fluxer","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fbenjojo%2Ftotp-ssh-fluxer","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbenjojo%2Ftotp-ssh-fluxer/lists"}