5 ms·

Even better is to additionally setup a fake SSHd at port 22, so that port scanners do not even bother keeping on looking for the port and instead use what they

• mfontani 16y ago
  I use https://code.google.com/p/kippo/ https://code.google.com/p/kippo/ as a ssh honeypot, and https://github.com/mfontani/kippo-stats https://github.com/mfontani/kippo-stats to display stats about it (number of attempts, successful logins, most usernames tried, most passwords tried for "root"). The data is quite interesting. Here's a snapshot of where most "attacks" to my honeypot originate from (the more, the brighter): http://darkpan.com/files/latlong255.png http://darkpan.com/files/latlong255.png
  • nodata 16y ago
    kippo's code is going to be less audited than openssh's. do you run kippo as root? is the risk of running kippo worth the stats?
    • gbrindisi 16y ago
      kippo can't be executed as root.
      • dmm 16y ago
        How does it open a server on a port <1024 without privileged access?
        • epochwolf 16y ago
          You use iptables to route port 22 on the external interface to a high port on localhost
        • rosser 16y ago
          It probably doesn't. # accept traffic to the normal ssh port iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT # accept traffic on the port kippo is listening on iptables -A INPUT -i eth0 -p tcp --dport 2222 -j ACCEPT # direct traffic inbound on port 22 to port 2222 iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 22 -j REDIRECT --to-port 2222 Make sure also to add an ACCEPT rule for traffic to whatever port sshd is actually bound to.
          • dmm 16y ago
            That's fine so long as you trust all of the users on your system. Otherwise they could potentially get something running on port 22. Which, so long as you aren't actually sending auth info to 22, probably isn't a big deal.
          • cft 16y ago
            http://www.faqs.org/docs/iptables/traversingoftables.html http://www.faqs.org/docs/iptables/traversingoftables.html Table nat is traversed <b>before</b> filter table. Therefore, the rule iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT is unnecessary.
            • gcb 16y ago
              Everyone, hear the post above. Damn little arrows and imprecise HTC touchscreens... downvoted you by mistake
    • mfontani 16y ago
      I run it as a dedicated user, on a high port. Port 22 of the router is merely forwarded to the internal high port I use. Sure, I could chroot the thing as well.
• dedward 16y ago
  As interesting and fun as honeypots are - unless it's your own gig, or the data from the honeypot fits into a larger security plan, it's just adding one more thing to manage. Move the port, run denyhosts, and in general just have access firewalled off to begin with.