A lightweight SSH honeypot that logs all connection attempts and activity without executing commands.
sshesame is an SSH honeypot—a fake SSH server that accepts all connection attempts and logs detailed activity without executing any commands on the host. It helps security professionals detect, analyze, and understand SSH-based attacks by capturing authentication attempts, client interactions, and input commands in a safe, isolated environment.
Security researchers, system administrators, and DevOps teams who need to monitor SSH access attempts, study attack patterns, or deploy deceptive security measures on their networks.
Developers choose sshesame for its simplicity, safety, and comprehensive logging—it’s a lightweight, self-contained tool that requires minimal setup, runs without risk to the host, and provides actionable security insights.
An easy to set up and use SSH honeypot, a fake SSH server that lets anyone in and logs their activity
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Available as a single binary, Docker container, or systemd service with minimal configuration, making deployment quick and straightforward, as detailed in the installation section.
Logs authentication attempts, client versions, channel requests, and input commands comprehensively, evidenced by the sample output showing captured SSH interactions.
Designed not to execute commands or make network requests, ensuring zero risk to the host system, a key point emphasized in the project philosophy.
Supports YAML config files for customizing listening addresses and logging outputs, with sample configurations provided for adaptability.
Only logs activity without simulating command execution or file system interactions, which may reduce engagement with sophisticated attackers and limit threat analysis.
Logs to stdout or files without built-in integration with SIEM systems or alerting mechanisms, requiring additional setup for advanced security monitoring.
The README warns that official Debian packages may be outdated, relying on GitHub releases for updates, which could complicate maintenance in some environments.