9

Instead of making the possible hackers from port scanning my server I would like to just fake that sshd is listening on port 22 and log the attempts. Will it make sense doing that? If yes, what actively developed tools/libraries are available.

Improve this question
1
  • 1
    But you'd better remember that installing any additional software increases risks of penetration anyway. It might be true that OpenSSH would be stronger to break-in than anything "fake" like honeypot, for e. g.. So it means you would need hardening its install in a way.
    – poige
    Oct 30, 2013 at 2:25

4 Answers 4

Reset to default
10

You can use an SSHD honeypot like Kippo or Kojoney

Improve this answer
10

You can also simply log all attempts to connect to port 22 with iptables, even if nothing is listening on that port:

$ sudo iptables -A INPUT -p tcp  --dport 2222 -j LOG
$ nc localhost 2222
$ tail -n1 /var/log/syslog
Oct 26 13:35:07 localhost kernel: [325488.300080] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.0.0.1 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=56580 DF PROTO=TCP SPT=35625 DPT=2222 WINDOW=43690 RES=0x00 SYN URGP=0
Improve this answer
1
  • Will the log only store one or append on top of each other ?
    – code-8
    Apr 25, 2021 at 2:55
4

To answer the question "Will it make sense doing that?" I ask, "Are you a security researcher?" If you answer yes, then running an ssh honeypot would make sense.

If you're just running a production service and you don't care about failed scans, just run your sshd on a different port with additional authentication mechanisms (such as public key only, or requiring a Yubikey or similar device) and drop port 22 traffic without logging it.

There are brute force ssh worms actively scanning the Internet that will probe your ssh port all day long, and if you're not going to look at the data from firewall logs or honeypots, all you're doing is wasting disk space.

Improve this answer
1
  • 3
    The question for me isn't "Can I do this?", but "Should I do this?". I see many a sysadmin or developer doing things because they think they should, or because someone told them they should or because "everyone" else is doing it. Doing anything without having clearly defined needs, objectives and expected outcomes is a waste of time, money and energy.
    – joeqwerty
    Oct 29, 2013 at 22:11
3

You want a honeypot.

Example: http://code.google.com/p/kippo/

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .