A low-interaction SSH honeypot that logs attacker IPs, usernames, and passwords for security intelligence.
SSH Honeypot is a fake SSH server that logs IP addresses, usernames, and passwords from incoming SSH connection attempts. It is designed as a low-interaction honeypot, meaning it does not allow attackers to log in, making it safe for gathering intelligence on brute-force attacks and profiling malicious activity.
Security researchers, penetration testers, and system administrators who want to monitor SSH-based attack patterns, gather threat intelligence, or simulate honeypot environments in CTF (Capture The Flag) competitions.
Developers choose SSH Honeypot for its simplicity, lightweight design, and advanced features like HASSH fingerprinting and JSON logging, which provide detailed attack insights without the risk of real system compromise.
Fake sshd that logs ip addresses, usernames, and passwords.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Records IP addresses, usernames, and passwords from SSH connection attempts, providing detailed intelligence on brute-force attacks without risk of compromise.
Identifies client software like OpenSSH or PuTTY using HASSH signatures, enabling precise profiling of attack sources for better threat analysis.
Outputs logs in JSON format for easy ingestion by Splunk or ElasticSearch, and supports syslog for centralized log management, enhancing analytics capabilities.
Drops root privileges after binding to privileged ports (e.g., port 22), reducing attack surface and improving safety in deployment.
The author explicitly states it's 'not meant for production usage,' limiting reliability and support for critical, high-availability environments.
macOS is officially unsupported with untested features like JSON logging and HASSH, making it risky for teams on Apple ecosystems.
Requires manual compilation, installation of dependencies like libssh and json-c, and key generation, which can be time-consuming compared to turnkey solutions.
JSON logs sent to remote hosts use UDP without encryption, as admitted in the README, posing a data leakage risk if sensitive credentials are intercepted.