Instead of making the possible hackers from port scanning my server I would like to just fake that sshd is listening on port 22 and log the attempts. Will it make sense doing that? If yes, what actively developed tools/libraries are available.

  • 1
    But you'd better remember that installing any additional software increases risks of penetration anyway. It might be true that OpenSSH would be stronger to break-in than anything "fake" like honeypot, for e. g.. So it means you would need hardening its install in a way. – poige Oct 30 '13 at 2:25

You can use an SSHD honeypot like Kippo or Kojoney


You can also simply log all attempts to connect to port 22 with iptables, even if nothing is listening on that port:

$ sudo iptables -A INPUT -p tcp  --dport 2222 -j LOG
$ nc localhost 2222
$ tail -n1 /var/log/syslog
Oct 26 13:35:07 localhost kernel: [325488.300080] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC= DST= LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=56580 DF PROTO=TCP SPT=35625 DPT=2222 WINDOW=43690 RES=0x00 SYN URGP=0 

To answer the question "Will it make sense doing that?" I ask, "Are you a security researcher?" If you answer yes, then running an ssh honeypot would make sense.

If you're just running a production service and you don't care about failed scans, just run your sshd on a different port with additional authentication mechanisms (such as public key only, or requiring a Yubikey or similar device) and drop port 22 traffic without logging it.

There are brute force ssh worms actively scanning the Internet that will probe your ssh port all day long, and if you're not going to look at the data from firewall logs or honeypots, all you're doing is wasting disk space.

  • 3
    The question for me isn't "Can I do this?", but "Should I do this?". I see many a sysadmin or developer doing things because they think they should, or because someone told them they should or because "everyone" else is doing it. Doing anything without having clearly defined needs, objectives and expected outcomes is a waste of time, money and energy. – joeqwerty Oct 29 '13 at 22:11

You want a honeypot.

Example: http://code.google.com/p/kippo/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.