[PATCH] gnu: services: Add endlessh.

Nicolò Balzarotti wrote on 14 Jan 2020 22:21

Recipients:(address . guix-patches@gnu.org)

Message-ID:874kwx91k6.fsf@guixSD.i-did-not-set--mail-host-address--so-tickle-me

Hello guix!

This is my first service :) I know I still miss documentation and tests,

but before diving into it I wanted a general feedback on it (so that if

we decide to change something I don't have to adjust the docs and the

tests twice).

Endlessh is already in the repo, but for those who don't know: it's a

fake ssh server; it should be used to prevent bruteforce attacks and the

like by "freezing" the connection on the standard port (while the real

ssh server is on another non-standard port). So, I don't know if as

default port should be 22 or, as it is now, 2222 (program's default).

My second doubt is regarding the place; it's an ssh server, but its main

purpose is for security? Maybe should go under admin.scm? I'm not sure

Last thing: bind-family as a list of allowed values is a suggetion from

IRC @leoprikler. Thanks for your help there!

Waiting for your feedback,

Nicolò

From 63f975ec47de8ab951beaac6781327faf06d0cac Mon Sep 17 00:00:00 2001

* gnu/services/ssh.scm (endlessh): New variable.

---

gnu/services/ssh.scm | 74 +++++++++++++++++++++++++++++++++++++++++++-

1 file changed, 73 insertions(+), 1 deletion(-)

Toggle diff (92 lines)diff --git a/gnu/services/ssh.scm b/gnu/services/ssh.scm
index d2dbb8f80d..d2729fb059 100644
--- a/gnu/services/ssh.scm
+++ b/gnu/services/ssh.scm
@@ -45,7 +45,11 @@
             dropbear-configuration
             dropbear-configuration?
             dropbear-service-type
-            dropbear-service))
+            dropbear-service
+
+            endlessh-configuration
+            endlessh-configuration?
+            endlessh-service-type))
 
 ;;; Commentary:
 ;;;
@@ -628,4 +632,72 @@ daemon} with the given @var{config}, a @code{<dropbear-configuration>}
 object."
   (service dropbear-service-type config))
 
+
+;;;
+;;; Endlessh.
+;;;
+
+(define-record-type* <endlessh-configuration>
+  endlessh-configuration make-endlessh-configuration
+  endlessh-configuration?
+  ;; list of two symbols, allowed values are ipv4, ipv6 or both
+  (bind-family endlessh-configuration-bind-family (default '(ipv4 ipv6)))
+  ;; integer
+  (delay endlessh-configuration-delay (default 10000))
+  ;; integer
+  ;; Must be in the range
+  (length endlessh-configuration-length (default 32))
+  ;; integer
+  (max-clients endlessh-configuration-max-clients (default 4096))
+  ;; integer
+  (port-number endlessh-configuration-port-number (default 2222))
+  ;; integer
+  ;; Allowed values are 0, 1 and 2
+  (log-level endlessh-configuration-log-level (default 0)))
+
+(define (endlessh-config->conf config)
+  "Convert the CONFIG of type <endlessh-config> to a config file."
+  (let* ((family (endlessh-configuration-bind-family config))
+	 (ipv4 (member 'ipv4 family))
+	 (ipv6 (member 'ipv6 family))
+	 (port (endlessh-configuration-port-number config))
+	 (delay (endlessh-configuration-delay config))
+	 (length (endlessh-configuration-length config))
+	 (log-level (endlessh-configuration-log-level config))
+	 (max-clients (endlessh-configuration-max-clients config))
+	 (bind
+	  ;; check if both are true (0), or only one of them is present
+	  (if (not (and (equal? ipv4 ipv6) ipv4))
+	      (if ipv4 4
+		  (if ipv6 6
+		      (throw 'endlessh-error
+			     "bind-family must contain at least one value")))
+	      0)))
+    (mixed-text-file "endlessh.conf"
+		     "# Generated by 'endlessh-config'.\n\n"
+		     "Port " (number->string port) "\n"
+		     "Delay " (number->string delay) "\n"
+		     "MaxLineLength " (number->string length) "\n"
+		     "MaxClients " (number->string max-clients) "\n"
+		     "LogLevel " (number->string log-level) "\n"
+		     "BindFamily " (number->string bind) "\n")))
+
+(define (endlessh-shepherd-service config)
+  (shepherd-service
+   (documentation "Run endlessh tarpit server.")
+   (provision '(endlessh))
+   (start #~(make-forkexec-constructor
+	     (list #$(file-append endlessh "/bin/endlessh")
+		   "-f" #$(endlessh-config->conf config))))
+   (stop  #~(make-kill-destructor))))
+
+(define endlessh-service-type
+  (service-type
+   (name 'endlessh)
+   (description "Run endlessh tarpit server.")
+   (extensions
+    (list (service-extension shepherd-root-service-type
+                             (compose list endlessh-shepherd-service))))
+   (default-value (endlessh-configuration))))
+
 ;;; ssh.scm ends here
-- 
2.24.1

Oleg Pykhalov wrote on 25 Jul 2020 22:08

Recipients:(name . Nicolò Balzarotti)(address . anothersms@gmail.com)(address . 39136@debbugs.gnu.org)

Message-ID:87365fl5mb.fsf@gmail.com

Hi,

That patch was forgotten for some reason, but we still have a succeeded

to build ‘endlessh’ package which missing a service! :-)

anothersms@gmail.com (Nicolò Balzarotti) writes:

Toggle quote (5 lines)

> This is my first service :) I know I still miss documentation and tests,

> but before diving into it I wanted a general feedback on it (so that if

> we decide to change something I don't have to adjust the docs and the

> tests twice).

Tests are appreciated ;-)

Toggle quote (6 lines)

> Endlessh is already in the repo, but for those who don't know: it's a

> fake ssh server; it should be used to prevent bruteforce attacks and the

> like by "freezing" the connection on the standard port (while the real

> ssh server is on another non-standard port). So, I don't know if as

> default port should be 22 or, as it is now, 2222 (program's default).

2222 is OK. But we need this be documented in ‘doc/guix.texi’. Could

you take a look on this, please?

Toggle quote (3 lines)

> My second doubt is regarding the place; it's an ssh server, but its main

> purpose is for security? Maybe should go under admin.scm? I'm not sure

I think gnu/services/ssh.scm is good.

[…]

Toggle quote (6 lines)

> +(define-record-type* <endlessh-configuration>

> + endlessh-configuration make-endlessh-configuration

> + endlessh-configuration?

> + ;; list of two symbols, allowed values are ipv4, ipv6 or both

> + (bind-family endlessh-configuration-bind-family (default '(ipv4 ipv6)))

Please, move ‘(default …)’ things on a separate line.

[…]

Otherwise LGTM. Could you send an update with a documented service?

Thanks,

Oleg.

Joshua Branson wrote on 15 Mar 2021 17:29

[PATCH 1/2] services: Add endlessh service.

Recipients:(address . 39136@debbugs.gnu.org)(name . Nicolò Balzarotti)(address . nicolo@nixo.xyz)

Message-ID:20210315162949.17092-1-jbranso@dismail.de

* gnu/services/ssh.scm: Add endlessh service

(<endlessh-configuration>): New record type.

(endlessh-config->conf, endlessh-shepherd-service, endlessh-service-type): New procedures.

---

gnu/services/ssh.scm | 73 ++++++++++++++++++++++++++++++++++++++++++++

1 file changed, 73 insertions(+)

Toggle diff (93 lines)diff --git a/gnu/services/ssh.scm b/gnu/services/ssh.scm
index 1891db0487..aad9bbc754 100644
--- a/gnu/services/ssh.scm
+++ b/gnu/services/ssh.scm
@@ -54,6 +54,10 @@
             autossh-configuration?
             autossh-service-type
 
+            endlessh-configuration
+            endlessh-configuration?
+            endlessh-service-type
+
             webssh-configuration
             webssh-configuration?
             webssh-service-type
@@ -739,6 +743,75 @@ object."
                              autossh-service-activation)))
    (default-value (autossh-configuration))))
 
+
+;;;
+;;; Endlessh.
+;;;
+
+(define-record-type* <endlessh-configuration>
+  endlessh-configuration make-endlessh-configuration
+  endlessh-configuration?
+  ;; list of two symbols, allowed values are ipv4, ipv6 or both
+  (bind-family endlessh-configuration-bind-family (default '(ipv4 ipv6)))
+  ;; integer
+  (delay endlessh-configuration-delay (default 10000))
+  ;; integer
+  ;; Must be in the range
+  (length endlessh-configuration-length (default 32))
+  ;; integer
+  (max-clients endlessh-configuration-max-clients (default 4096))
+  ;; integer
+  (port-number endlessh-configuration-port-number (default 2222))
+  ;; integer
+  ;; Allowed values are 0, 1 and 2
+  (log-level endlessh-configuration-log-level (default 0)))
+
+(define (endlessh-config->conf config)
+  "Convert the CONFIG of type <endlessh-config> to a config file."
+  (let* ((family (endlessh-configuration-bind-family config))
+	 (ipv4 (member 'ipv4 family))
+	 (ipv6 (member 'ipv6 family))
+	 (port (endlessh-configuration-port-number config))
+	 (delay (endlessh-configuration-delay config))
+	 (length (endlessh-configuration-length config))
+	 (log-level (endlessh-configuration-log-level config))
+	 (max-clients (endlessh-configuration-max-clients config))
+	 (bind
+	  ;; check if both are true (0), or only one of them is present
+	  (if (not (and (equal? ipv4 ipv6) ipv4))
+	      (if ipv4 4
+		  (if ipv6 6
+		      (throw 'endlessh-error
+			     "bind-family must contain at least one value")))
+	      0)))
+    (mixed-text-file "endlessh.conf"
+		     "# Generated by 'endlessh-config'.\n\n"
+		     "Port " (number->string port) "\n"
+		     "Delay " (number->string delay) "\n"
+		     "MaxLineLength " (number->string length) "\n"
+		     "MaxClients " (number->string max-clients) "\n"
+		     "LogLevel " (number->string log-level) "\n"
+		     "BindFamily " (number->string bind) "\n")))
+
+(define (endlessh-shepherd-service config)
+  (shepherd-service
+   (documentation "Run endlessh tarpit server.")
+   (provision '(endlessh))
+   (start #~(make-forkexec-constructor
+	     (list #$(file-append endlessh "/bin/endlessh")
+		   "-f" #$(endlessh-config->conf config))))
+   (stop  #~(make-kill-destructor))))
+
+(define endlessh-service-type
+  (service-type
+   (name 'endlessh)
+   (description "Run endlessh tarpit server.")
+   (extensions
+    (list (service-extension shepherd-root-service-type
+                             (compose list endlessh-shepherd-service))))
+   (default-value (endlessh-configuration))))
+
+
 
 ;;;
 ;;; WebSSH
-- 
2.30.0

Joshua Branson wrote on 15 Mar 2021 17:29

[PATCH 2/2] services: containerized endlessh

Recipients:(address . 39136@debbugs.gnu.org)(name . Joshua Branson)(address . jbranso@dismail.de)

Message-ID:20210315162949.17092-2-jbranso@dismail.de

doc: endlessh service documentation.

* doc/guix.texi (Networking Services): New endlessh-service-type section.

services: containerized endlessh

* gnu/services/ssh.scm (endlessh-config->conf): make-forkexec-contructor ->

make-forkexec-constructor/container. and attempted to enable logging to syslog.

(define-record-type* <endlessh-configuration>)

move default values of endlessh configuration to separate line.

Add copyright line for Nicolo.

---

doc/guix.texi | 60 ++++++++++++++++++++++++++++++++++++++++++++

gnu/services/ssh.scm | 35 ++++++++++++++++++--------

2 files changed, 85 insertions(+), 10 deletions(-)

Toggle diff (145 lines)diff --git a/doc/guix.texi b/doc/guix.texi
index 464c1141d8..38807b3069 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -17081,6 +17081,66 @@ may cause undefined behaviour.
 @end table
 @end deftp
 
+@cindex Endlessh
+@deffn {Scheme Variable} endlessh-service-type
+This is the type for the @uref{https://github.com/skeeto/endlessh,
+Endlessh} program that delays ssh clients for days at a time by
+@emph{very slowly} sending a random and endless SSH banner.  The smart
+hacker will put endlessh running on port 22, and let crackers get stuck
+in this tarpit.  This lets your real ssh server run more securely on a
+non-standard port.
+
+For example:
+
+@lisp
+(service endlessh-service-type
+  (endlessh-configuration
+    (port-number 22)))
+@end lisp
+
+@end deffn
+
+@deftp {Data Type} endlessh-configuration
+Data type representing the configuration for @code{endlessh-service}.
+@table @asis
+@item @code{package} (default: @var{endlessh})
+@code{endlessh} package to use.
+
+@item @code{bind-family} (default: @code{'(ipv4 ipv6)})
+This specifies if endlessh should use ipv4 and/or ipv6.
+
+@item @code{delay} (default: @code{10000})
+The endless banner is sent one line at a time. This is the delay
+in milliseconds between individual lines.
+
+@item @code{length} (default: @code{32})
+The length of each line is randomized. This controls the maximum length
+of each line. Shorter lines may keep clients on for longer if they give
+up after a certain number of bytes.
+
+@item @code{max-clients} (default: @code{4096})
+Maximum number of connections to accept at a time. Connections beyond
+this are not immediately rejected, but will wait in the queue.
+
+@item @code{port-number} (default: @code{2222})
+The port on which to listen for new SSH connections.  Most users who
+want to use endlessh as intended should set this port number to
+@code{22}.
+
+@item @code{log-level} (default: @code{0})
+Set the detail level for the log.
+@table @asis
+@item  0 = Quiet
+@item  1 = Standard, useful log messages
+@item  2 = Very noisy debugging information
+@end table
+
+@item @code{syslog} (default: @code{#f})
+Print diagnostics to syslog instead of standard output
+
+@end table
+@end deftp
+
 @cindex WebSSH
 @deffn {Scheme Variable} webssh-service-type
 This is the type for the @uref{https://webssh.huashengdun.org/, WebSSH}
diff --git a/gnu/services/ssh.scm b/gnu/services/ssh.scm
index aad9bbc754..838655cf2c 100644
--- a/gnu/services/ssh.scm
+++ b/gnu/services/ssh.scm
@@ -6,6 +6,8 @@
 ;;; Copyright © 2019 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2020 pinoaffe <pinoaffe@airmail.cc>
 ;;; Copyright © 2020 Oleg Pykhalov <go.wigust@gmail.com>
+;;; Copyright © 2020 Nicolò Balzarotti <nicolo@nixo.xyz>
+;;; Copyright @ 2021 Joshua Branson <jbranso@dismail.de>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -752,19 +754,25 @@ object."
   endlessh-configuration make-endlessh-configuration
   endlessh-configuration?
   ;; list of two symbols, allowed values are ipv4, ipv6 or both
-  (bind-family endlessh-configuration-bind-family (default '(ipv4 ipv6)))
+  (bind-family endlessh-configuration-bind-family
+               (default '(ipv4 ipv6)))
   ;; integer
-  (delay endlessh-configuration-delay (default 10000))
+  (delay endlessh-configuration-delay
+         (default 10000))
   ;; integer
   ;; Must be in the range
-  (length endlessh-configuration-length (default 32))
+  (length endlessh-configuration-length
+          (default 32))
   ;; integer
-  (max-clients endlessh-configuration-max-clients (default 4096))
+  (max-clients endlessh-configuration-max-clients
+               (default 4096))
   ;; integer
-  (port-number endlessh-configuration-port-number (default 2222))
+  (port-number endlessh-configuration-port-number
+               (default 2222))
   ;; integer
   ;; Allowed values are 0, 1 and 2
-  (log-level endlessh-configuration-log-level (default 0)))
+  (log-level endlessh-configuration-log-level
+             (default 0)))
 
 (define (endlessh-config->conf config)
   "Convert the CONFIG of type <endlessh-config> to a config file."
@@ -797,15 +805,22 @@ object."
   (shepherd-service
    (documentation "Run endlessh tarpit server.")
    (provision '(endlessh))
-   (start #~(make-forkexec-constructor
-	     (list #$(file-append endlessh "/bin/endlessh")
-		   "-f" #$(endlessh-config->conf config))))
+   (start #~(make-forkexec-constructor/container
+	     `(list #$(file-append endlessh "/bin/endlessh")
+                    ,(if (positive? (endlessh-configuration-log-level config))
+                         "-s"
+                         "")
+		    "-f" #$(endlessh-config->conf config))))
    (stop  #~(make-kill-destructor))))
 
 (define endlessh-service-type
   (service-type
    (name 'endlessh)
-   (description "Run endlessh tarpit server.")
+   (description "Endlessh is an SSH tarpit that very slowly sends an endless,
+random SSH banner. It keeps SSH clients locked up for hours or even days at a
+time. The purpose is to put your real SSH server on another port and then let
+the script kiddies get stuck in this tarpit instead of bothering a real
+server.")
    (extensions
     (list (service-extension shepherd-root-service-type
                              (compose list endlessh-shepherd-service))))
-- 
2.30.0

Joshua Branson wrote on 16 Mar 2021 16:32

My endlessh patch series

Recipients:(address . 39136@debbugs.gnu.org)

Message-ID:87a6r39ksa.fsf@dismail.de

So I've been working on this endlessh service for a while. I believe

it could be better, but perfectionist can only do one thing perfectly:

nothing. So I've submitted the above patch series. Let me know if it

needs more work.

At the moment, I believe that endlessh runs as root. It would be nice

to let it run as user nobody or something like that.

The endlessh systemd file provides an example of how to do that:

https://github.com/skeeto/endlessh/blob/master/util/endlessh.service

## If you want Endlessh to bind on ports < 1024

## 1) run:

## setcap 'cap_net_bind_service=+ep' /usr/local/bin/endlessh

## 2) uncomment following line

#AmbientCapabilities=CAP_NET_BIND_SERVICE

## 3) comment following line

PrivateUsers=true

Though setcap 'cap_net_bind_service=+ep' is linux specific. And I'm

not certain if guix has a method for running setcap on items in the

store.

Those are just some relevant thoughts for improving the service!

Thanks!

Joshua Branson wrote on 16 Mar 2021 16:42

issues.guix.org not showing patch series?

Recipients:(address . 39136@debbugs.gnu.org)(address . bug-guix@gnu.org)

Message-ID:878s6n9kbp.fsf@dismail.de

Hello!

I just submitted a patch series for an endlessh service!

However, issues.guix.gnu.org/39136 does not properly show the patch

series. :( Maybe I just submitted the patch series incorrectly. :)

You can see the patch series here:

https://lists.gnu.org/archive/html/guix-patches/2021-03/msg00672.html

And via

M-x debbugs-gnu-bugs RET 39136 RET

I'm not certain what the issue is...

This is the command that I used to send the patch series.

#+BEGIN_SRC sh

git send-email --to=39136@debbugs.gnu.org HEAD~2

#+END_SRC

Thanks!

Your friend,

Joshua

Joshua Branson wrote on 19 Mar 2021 17:22

Re: bug#39136: [PATCH] gnu: services: Add endlessh.

Recipients:(address . 39136@debbugs.gnu.org)(address . go.wigust@gmail.com)

Message-ID:87h7l7kt9r.fsf_-_@dismail.de

Ping for Oleg!

Thanks!

Joshua

P.S. I forget to include your email in the patch series. I know the

patch series could be better, but I figured I'd rather submit something

rather than nothing. Thanks!

Joshua Branson (joshuaBPMan in #guix)

Sent from Emacs and Gnus

https://gnucode.me

https://video.hardlimit.com/accounts/joshua_branson/video-channels

https://propernaming.org

"You can have whatever you want, as long as you help

enough other people get what they want." - Zig Ziglar

Oleg Pykhalov wrote on 22 Mar 2021 19:45

Recipients:(name . Joshua Branson)(address . jbranso@dismail.de)(address . 39136@debbugs.gnu.org)

Message-ID:87zgyv2fjd.fsf_-_@gmail.com

Hello,

I failed to test endlessh with "services: containerized endlessh" patch

in a virtual machine. Unfortunately at the moment I'm not familiar with

‘make-forkexec-constructor/container’ machinery, and have no idea about

that causing the issue of boot hang. Failed VM config in attachment.

;; This is an operating system configuration for a VM image.
;; Modify it as you see fit and instantiate the changes by running:
;;
;;   guix system reconfigure /etc/config.scm
;;

(use-modules (gnu) (guix) (srfi srfi-1))
(use-service-modules desktop networking ssh xorg)
(use-package-modules bootloaders certs fonts nvi
                     package-management wget xorg)

(define vm-image-motd (plain-file "motd" "
\x1b[1;37mThis is the GNU system.  Welcome!\x1b[0m

This instance of Guix is a template for virtualized environments.
You can reconfigure the whole system by adjusting /etc/config.scm
and running:

  guix system reconfigure /etc/config.scm

Run '\x1b[1;37minfo guix\x1b[0m' to browse documentation.

\x1b[1;33mConsider setting a password for the 'root' and 'guest' \
accounts.\x1b[0m
"))

(operating-system
  (host-name "gnu")
  (timezone "Etc/UTC")
  (locale "en_US.utf8")
  (keyboard-layout (keyboard-layout "us" "altgr-intl"))

  ;; Label for the GRUB boot menu.
  (label (string-append "GNU Guix " (package-version guix)))

  (firmware '())

  ;; Below we assume /dev/vda is the VM's hard disk.
  ;; Adjust as needed.
  (bootloader (bootloader-configuration
               (bootloader grub-bootloader)
               (target "/dev/vda")
               (terminal-outputs '(console))))
  (file-systems (cons (file-system
                        (mount-point "/")
                        (device "/dev/vda1")
                        (type "ext4"))
                      %base-file-systems))

  (users (cons (user-account
                (name "guest")
                (comment "GNU Guix Live")
                (password "")                     ;no password
                (group "users")
                (supplementary-groups '("wheel" "netdev"
                                        "audio" "video")))
               %base-user-accounts))

  ;; Our /etc/sudoers file.  Since 'guest' initially has an empty password,
  ;; allow for password-less sudo.
  (sudoers-file (plain-file "sudoers" "\
root ALL=(ALL) ALL
%wheel ALL=NOPASSWD: ALL\n"))

  (packages (append (list nss-certs wget)
                    %base-packages))

  (services
   (append (list ;; Uncomment the line below to add an SSH server.
                 ;; (service openssh-service-type
                 ;;          (openssh-configuration
                 ;;           (port-number 2222)))

                 (service endlessh-service-type
                          (endlessh-configuration
                           (port-number 2222)))

                 ;; Use the DHCP client service rather than NetworkManager.
                 (service dhcp-client-service-type))

           ;; Remove GDM, ModemManager, NetworkManager, and wpa-supplicant,
           ;; which don't make sense in a VM.
           (remove (lambda (service)
                     (let ((type (service-kind service)))
                       (or (memq type
                                 (list gdm-service-type
                                       wpa-supplicant-service-type
                                       cups-pk-helper-service-type
                                       network-manager-service-type
                                       modem-manager-service-type))
                           (eq? 'network-manager-applet
                                (service-type-name type)))))
                   (modify-services %base-services
                     (login-service-type config =>
                                         (login-configuration
                                          (inherit config)
                                          (motd vm-image-motd)))))))

  ;; Allow resolution of '.local' host names with mDNS.
  (name-service-switch %mdns-host-lookup-nss))

I succeeded to test without "services: containerized endlessh". If wish

to fix a problem, ping me then you done. Otherwise I could push a

working version without containerization.

Thanks,

Oleg.

Joshua Branson wrote on 4 Apr 2021 15:31

Recipients:(name . Oleg Pykhalov)(address . go.wigust@gmail.com)(address . 39136@debbugs.gnu.org)

Message-ID:878s5ymb08.fsf_-_@dismail.de

Oleg Pykhalov <go.wigust@gmail.com> writes:

Toggle quote (14 lines)> Hello,
>
> I failed to test endlessh with "services: containerized endlessh" patch
> in a virtual machine.  Unfortunately at the moment I'm not familiar with
> ‘make-forkexec-constructor/container’ machinery, and have no idea about
> that causing the issue of boot hang.  Failed VM config in attachment.
>
>
>
>
> I succeeded to test without "services: containerized endlessh".  If wish
> to fix a problem, ping me then you done.  Otherwise I could push a
> working version without containerization.

Oh, I suppose that I will try to get containerization working on this

service. I'd prefer to have it containerized, since it is running as

root.

Thanks!

Toggle quote (5 lines)

> Thanks,

> Oleg.

--
Joshua Branson (joshuaBPMan in #guix)
Sent from Emacs and Gnus
  https://gnucode.me
  https://video.hardlimit.com/accounts/joshua_branson/video-channels
  https://propernaming.org
  "You can have whatever you want, as long as you help
enough other people get what they want." - Zig Ziglar

is:open	open issues
is:done	closed issues
submitter:<who>	search issue submitter
author:<who>	search by message author
date:yesterday..now	search by issue date
mdate:3m..2d	search by message date