Fake sshd that logs ip addresses, usernames, and passwords.
Switch branches/tags
Nothing to show
Clone or download
Type Name Latest commit message Commit time
Failed to load latest commit information.
bin Fixed .gitignore, added comment so this hopefully doesn't get broken … Apr 18, 2017
scripts initial commit Jan 4, 2017
src added comments for flags Aug 4, 2017
.gitignore fixed Apr 18, 2017
INSTALL.md Updated README and INSTALL Apr 18, 2017
LICENSE.md updated dates Feb 21, 2017
Makefile added -Wall flag Apr 25, 2017
MakefileOSX Added MakefileOSX Apr 18, 2017
README.md whitespace Jul 24, 2017
TODO.md added packages, removed Fail2ban Jul 24, 2017


SSH Honeypot

This program listens for incoming ssh connections and logs the ip address, username, and password used. This was written to gather rudimentary intelligence on brute force attacks.



Make sure libssh is installed

$ apt install libssh-dev


Make sure that xcode is up to date.

Install libssh

$ brew install libssh

Specify MakefileOSX with make:

$ make -f MakefileOSX

Build and Run

$ make
$ ssh-keygen -t rsa -f ./ssh-honeypot.rsa
$ bin/ssh-honeypot -r ./ssh-honeypot.rsa


$ bin/ssh-honeypot -h

Syslog facilities

As of version 0.0.5, this supports logging to syslog. This feature is toggled with the -s flag. It is up to you to configure your syslog facilities appropriately. This logs to LOG_AUTHPRIV which is typically /var/log/auth.log. You may want to modify this to use one of the LOG_LOCAL facilities if you are worried about password leakage.

This was implemented to aggregate the data from several hosts into a centralized spot.

Dropping privileges

As of version 0.0.8, you can drop root privileges of this program after binding to a privileged port. You can now run this as nobody on port 22 for example instead of root, but have to initially start it as root:

$ sudo bin/ssh-honeypot -p 22 -u nobody

Beware that this chowns the logfile to the user specified as well.

Changing the Banner

List available banners

$ bin/ssh-honeypot -b

Set banner string

$ bin/ssh-honeypot -b "my banner string"

Set banner by index

$ bin/ssh-honeypot -i <banner index>