How to Set Multiple Passwords for "HIgh Profile" Accounts

Question

I generally set up servers with "important" services listening on nonstandard ports (e.g. SSH != 22) and rename or completely remove root/admin users. I recently thought that it might be fun to create an external jailed root (and happily decorated) account to keep an eye on the kiddies.**

Of course, breaking in must seem stupidly easy... but not too easy. Is there anyway to allow multiple passwords to let a user login to an account? I'm think about using a few from common dictionaries for Hydra/John the Ripper, and of course "password1" and "superman" will be on the list.

If Linux user management (Debian specifically) isn't accommodating enough for faux fun of this sort, what scripts exist that could emulate an SSH/SFTP login experience and dumping the guest into a deliciously sticky honeypot?

**Addition: I would never put a honeypot on a production server; however, if I were to forward them to another server through a firewall, the question remains the same: is it possible to allow multiple passwords for a user?

Answer 1

kippo is a honeypot server which is much safer to run, and more flexible. Its not a real linux install, its a python process that LOOK like a linux install. You can stuff as many fake passwords into it as you want, so you can have every word in the dictionary work as a root password if you like. Once someone logs in, they can look around but not modify anything. wget and curl will work, but they won't be able to access the files they download, they get saved for you to look at instead, and you get a log of all the commands they tried.

Answer 2

I would avoid doing this on a production server - you are asking for trouble, even a script-kiddie might break out of your jail, everyone gets lucky once.

I'm sure there are tools out there for creating honeypots if that's what you want to do, but I would keep it off your regular kit.

Answer 3

I would set up the honeypot on a separate system (so that if the honeypot would be broken out of, they are not on a important system ... but this can be done by a portforward from your real server to the honeypot.

(Sort of what they are doing here, but not really http://stankiewicz.free.fr/Wikka/wikka.php?wakka=HowtoHoneypot )

With IPTables a port forward looks like

iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 22 -j DNAT --to-destination 192.168.1.200:22
iptables -A FORWARD -p tcp -d 192.168.1.200 --dport 22 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

But you still needs to be careful about where the honeypot can communicate so it don't have access to internal server/admin nets etc.