Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Instead of making the possible hackers from port scanning my server I would like to just fake that sshd is listening on port 22 and log the attempts. Will it make sense doing that? If yes, what actively developed tools/libraries are available.

share|improve this question
1  
But you'd better remember that installing any additional software increases risks of penetration anyway. It might be true that OpenSSH would be stronger to break-in than anything "fake" like honeypot, for e. g.. So it means you would need hardening its install in a way. –  poige Oct 30 '13 at 2:25

4 Answers 4

up vote 10 down vote accepted

You can use an SSHD honeypot like Kippo or Kojoney

share|improve this answer

You can also simply log all attempts to connect to port 22 with iptables, even if nothing is listening on that port:

$ sudo iptables -A INPUT -p tcp  --dport 2222 -j LOG
$ nc localhost 2222
$ tail -n1 /var/log/syslog
Oct 26 13:35:07 localhost kernel: [325488.300080] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.0.0.1 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=56580 DF PROTO=TCP SPT=35625 DPT=2222 WINDOW=43690 RES=0x00 SYN URGP=0 
share|improve this answer

You want a honeypot.

Example: http://code.google.com/p/kippo/

share|improve this answer

To answer the question "Will it make sense doing that?" I ask, "Are you a security researcher?" If you answer yes, then running an ssh honeypot would make sense.

If you're just running a production service and you don't care about failed scans, just run your sshd on a different port with additional authentication mechanisms (such as public key only, or requiring a Yubikey or similar device) and drop port 22 traffic without logging it.

There are brute force ssh worms actively scanning the Internet that will probe your ssh port all day long, and if you're not going to look at the data from firewall logs or honeypots, all you're doing is wasting disk space.

share|improve this answer
3  
The question for me isn't "Can I do this?", but "Should I do this?". I see many a sysadmin or developer doing things because they think they should, or because someone told them they should or because "everyone" else is doing it. Doing anything without having clearly defined needs, objectives and expected outcomes is a waste of time, money and energy. –  joeqwerty Oct 29 '13 at 22:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.