Cowrie SSH/Telnet Honeypot
Clone or download
albert-ziegler and micheloosterhof Format expression cleanup (#986)
* remove extra brackets

* remove extra argument in format (should be a newline character I assume).
Latest commit f80d5bd Jan 18, 2019



travis codecov

Welcome to the Cowrie GitHub repository

This is the official repository for the Cowrie SSH and Telnet Honeypot effort.

What is Cowrie

Cowrie is a medium interaction SSH and Telnet honeypot designed to log brute force attacks and the shell interaction performed by the attacker.

Cowrie is developed by Michel Oosterhof.


You can join the Cowrie community at the following Slack workspace.


Some interesting features:

  • Fake filesystem with the ability to add/remove files. A full fake filesystem resembling a Debian 5.0 installation is included
  • Possibility of adding fake file contents so the attacker can cat files such as /etc/passwd. Only minimal file contents are included
  • Session logs are stored in an UML Compatible format for easy replay with original timings with the bin/playlog utility.
  • Cowrie saves files downloaded with wget/curl or uploaded with SFTP and scp for later inspection log

Additional functionality over standard kippo:

  • SFTP and SCP support for file upload
  • Support for SSH exec commands
  • Logging of direct-tcp connection attempts (ssh proxying)
  • Forward SMTP connections to SMTP Honeypot (e.g. mailoney)
  • Logging in JSON format for easy processing in log management solutions
  • Many, many additional commands


Docker versions are available.


Software required:

  • Python 2.7+, (Limited Python 3 support available for SSH only)
  • python-virtualenv

For Python dependencies, see requirements.txt

Files of interest:

  • cowrie.cfg - Cowrie's configuration file. Default values can be found in etc/cowrie.cfg.dist
  • share/cowrie/fs.pickle - fake filesystem
  • etc/userdb.txt - credentials allowed or disallowed to access the honeypot
  • honeyfs/ - file contents for the fake filesystem - feel free to copy a real system here or use bin/fsctl
  • honeyfs/etc/ - pre-login banner
  • honeyfs/etc/motd - post-login banner
  • var/log/cowrie/cowrie.json - transaction output in JSON format
  • var/log/cowrie/cowrie.log - log/debug output
  • var/lib/cowrie/tty/ - session logs, replayable with the bin/playlog utility.
  • var/lib/cowrie/downloads/ - files transferred from the attacker to the honeypot are stored here
  • share/cowrie/txtcmds/ - file contents for simple fake commands
  • bin/createfs - used to create the fake filesystem
  • bin/playlog - utility to replay session logs

I have some questions!

Please visit the Slack workspace and join the #questions channel.


Many people have contributed to Cowrie over the years. Special thanks to:

  • Upi Tamminen (desaster) for all his work developing Kippo on which Cowrie was based
  • Dave Germiquet (davegermiquet) for TFTP support, unit tests, new process handling
  • Olivier Bilodeau (obilodeau) for Telnet support
  • Ivan Korolev (fe7ch) for many improvements over the years.
  • Florian Pelgrim (craneworks) for his work on code cleanup and Docker.
  • And many many others.