Configuring a High Interactivity SSH HoneyPot

Re:Configuring a High Interactivity SSH HoneyPot by TheSpiceIsLife on Monday November 28, 2016 @05:20AM (#13054534)

Congratulations you now have an SSH Honey Pot listening on the internet

I've often thought about doing this, but it seems like a wildly bad idea for someone like me who doesn't work in the field.

Anyone here who isn't a security expert tried this? How did it go?

[ Parent | on HN ]

Re:Configuring a High Interactivity SSH HoneyPot by bcook on Monday November 28, 2016 @05:34AM (#13054587)

I ran an SSH honeypot and every connection showed me something interesting; username/pass, shell commands, source host, whether it was automated or being typed by someone, which hosts they used for file downloads. This was maybe 10 years ago though... the internet seems to be much more serious and less curious nowadays.

Disclaimer: I am a wanna-be security hobbiest, at best.

[ Parent | on HN ]

Re:Configuring a High Interactivity SSH HoneyPot by iraklism on Monday November 28, 2016 @06:32AM (#13054769)

Spin up a VPS install a honeypot and observe.

You have nothing to lose. But please don't start mindlessly executing the various payloads people/bots will leave at this box.

[ Parent | on HN ]

Re:Configuring a High Interactivity SSH HoneyPot by jfindley on Monday November 28, 2016 @08:12AM (#13055160)

Be careful doing this - this may well be against the ToS of your VPS service.

[ Parent | on HN ]