Deploy an SSH honeypot for fun, which can both enhance security and serve as an electronic cricket.

Preface

Recently, an SSL certificate on an old server of mine expired. Applying for SSL certificates every time is too much hassle, so I directly deployed the Swag solution onto it.

Then I noticed this server had some security oversights, so I reinforced it. For the SSH part, I recalled a honeypot I had used before, which is perfect to deploy for some practice.

Modify SSH Server Port

The default SSH port is 22. First, modify the original SSH port to free up port 22 for honeypot use.

sudo nano /etc/ssh/sshd_config

Modify the following line:

#Port 22

Remove the comment and change it to your desired port number.

Then restart the SSH service.

sudo systemctl restart ssh

Note: Before modifying the port, ensure you have another method (such as physical access or console access) to connect to the server in case of issues with the new port configuration.

fakessh

FakeSSH is a Docker-based honeypot SSH server written in Go. Its main function is to record login attempts; all password authentication will fail, thus not providing attackers with terminal access.

Project address: https://github.com/fffaraz/fakessh

services:
  fakessh:
    container_name: fakessh
    image: fffaraz/fakessh
    restart: always
    ports:
      - 22:22
    command: /log
    volumes:
      - ./volumes/fakessh:/log

After deployment, if someone attempts a brute-force attack, I can get a password dictionary for free~

sshesame

SSHSame is a very simple and user-friendly SSH honeypot that can be quickly set up and deployed. Its main function is to simulate a fake SSH server, allowing anyone to connect while recording their activities. SSHSame does not perform any actions on the host, such as running commands or initiating network requests, ensuring system security. By logging connections and activities (e.g., channels, requests), SSHSame provides security researchers with an excellent tool to analyze and understand SSH attack behaviors.

https://github.com/jaksi/sshesame

services:
  sshesame:
    image: ghcr.io/jaksi/sshesame
    restart: always
    ports:
      - "2022:2022"
    volumes:
      - ./sshesame-data:/data
      #- ./sshesame.yaml:/config.yaml

After deployment, I tried it out. You can log in with any username and password, but once inside the shell, any command returns "not found."

Meanwhile, the logs will output what the incoming users are doing. It's quite amusing, like an electronic cricket 😃

Additionally

I've been using Typora to write articles recently, and while browsing today, I discovered two plugins/themes that enhance the Typora editing experience. I'd like to recommend them here:

• typora_plugin - It has a lot of features and I'm still exploring, but it feels quite useful. The only issue is that I installed Typora using scoop, and it seems the plugin needs to be reinstalled after every update.
• VLOOK - This is purely a theme. The plugin part works after exporting HTML, similar to VuePress, and it offers many features.

References

• https://zhuanlan.zhihu.com/p/659197095